NCBI ToolBox - Directory Traversal

NCBI ToolBox 2.0.7 through 2.2.26 legacy versions contain a path traversal vulnerability via viewcgi.cgi which may result in reading of arbitrary files i.e., significant information disclosure or file deletion via the nph-viewgif.cgi query string. id: CVE-2018-16716 info: name: NCBI ToolBox -...

CVE-2024-4040-CrushFTP-File-Read-vulnerability

CVE-2024-4040: CrushFTP Datei-Lese-Sicherheitslücke Übersicht Am 19. April 2024 wurde eine neue Zero-Day-Sicherheitslücke, die CrushFTP-Versionen unter 10.7.1 und 11.1.0 sowie ältere 9.x-Versionen betrifft, von dem Managed-File-Transfer-Anbieter CrushFTP an eine private Mailingliste gemeldet...

Hitachi Pentaho Business Analytics Server - Bypass Authorization

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. id: CVE-2022-43939 info: name: Hitachi Pentaho Business Analytics Server - Bypass Authorization author: daffainf...

CVE-2024-21626

PoC di CVE-2024-21626 Leggi il mio articolo completo per una spiegazione dettagliata qui. Articolo correlato Durante l'indagine su CVE-2024–21626 , ho scoperto una vulnerabilità trascurata nelle versioni precedenti di Docker e runC. Per saperne di più su ciò che ho trovato, leggi il seguente...

CVE-2026-9277

CVE-2026-9277 - Exploit di Command Injection in Shell-Quote Uno script exploit Proof of Concept PoC specializzato progettato per verificare e dimostrare CVE-2026-9277 —una vulnerabilità strutturale di Command Injection trovata nelle versioni legacy della libreria shell-quote = 1.8.3. Lo scanner...

bettercap

Questo repository è DEPRECATO, lo sviluppo di bettercap èspostato qui e ogni versione 2.0.0 è considerata LEGACY e NON SUPPORTATO...

CVE-2026-66058 Frappe: Unrestricted access to a Document Follow API

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API updatefollow is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0...

Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength in the BcKeyStoreSpi.engineLoad method, which for legacy BKS keystore versions 0 and 1 passes hMac.getMacSize 20 bytes for SHA-1 to generateDerivedMacParameters, where PKCS12ParametersGenerator divides it ...

CVE-2026-12860 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

DEBIAN-CVE-2026-59650

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-9571

Mattermost CVE-2026-9571 affects versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x

PYSEC-2026-490 Apache Pyfory python is vulnerable to deserialization of untrusted data

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stre...

DEBIAN-CVE-2026-39938

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graphtheme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31...

Linux Distros Unpatched Vulnerability : CVE-2026-48990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joser...

CVE-2026-40766 WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability

Subscriber SQL Injection in MasterStudy LMS = 3.7.25 versions...

Exploit for CVE-2026-9277

CVE-2026-9277 - Shell-Quote Command Injection Expl...

CVE-2026-6736

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce th...

CVE-2026-42539 IRIS has an Excessive Data Exposure issue

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch...

Authlib 安全漏洞

Authlib is an open-source library developed by Authlib, designed to build servers for OAuth and OpenID Connect. Versions of Authlib prior to 1.6.12 and 1.7.1 contained security vulnerabilities. These vulnerabilities stemmed from unauthenticated redirection in the OpenIDImplicitGrant and...