MAL-2026-17421 Malicious code in spo365-graph (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1 During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then...

WordPress MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin <= 5.0.18 - Authenticated (Store Manager+) SQL Injection vulnerability

Authenticated Store Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin MultiVendorX versions = 5.0.18...

copy.fail-mitigation-MLM

Multi-Linux Manager에서 copy-fail.sls 파일의 코드를 사용하여 새 구성 채널State Channel을 생성하세요. 구성 채널을 모든 머신에 할당하고 실행하거나 Highstate를 실행하세요. 이것은 임시 수정입니다!...

iVANTI-CVE-2021-38560

iVANTI-CVE-2021-38560 Ivanti Service Manager 2021.1 подвержен отражённому XSS через параметр appName, связанный с вызовами ConfigDB, например, в RelocateAttachments.aspx. Тип уязвимости: Межсайтовый скриптинг XSS Производитель продукта: IVANTI Затронутые версии продукта: Service Manager - =...

CVE-2026-20805-POC

CVE-2026-20805 PoC Проверка концепции для уязвимости раскрытия информации в Desktop Windows Manager dwm.exe от Microsoft. 📋 Сводка уязвимости ID: CVE-2026-20805 Продукт: Microsoft Windows Компонент: Desktop Windows Manager dwm.exe CWE-ID: CWE-200 Exposure of Sensitive Information to an Unauthoriz...

CVE-2021-45010-TinyFileManager-Exploit

CVE-2021-45010 CVE-2021-45010: Уязвимость обхода пути в функциональности загрузки файлов в tinyfilemanager.php в Tiny File Manager Project’s Tiny File Manager = 2.4.3 позволяет удалённым злоумышленникам с действительными учётными записями пользователей загружать вредоносные PHP-файлы в корневой...

CVE-2026-47574

A flaw was found in the NVIDIA Virtual GPU vGPU Manager for Linux. A local user with basic privileges can exploit an incorrect transfer of resources across isolation spheres. Successful exploitation could allow an attacker to execute arbitrary code, escalate privileges, cause a denial of service...

CVE-2026-47519

A flaw was found in nvidia-vgpu-software's Virtual GPU vGPU Manager for Linux. A local user with basic privileges can trigger an out-of-bounds read in the kernel-mode driver, accessing memory outside designated boundaries. A successful exploit could allow the attacker to execute arbitrary code,...

opencode-secure

Открытый ИИ-агент для написания кода. Установка YOLO curl -fsSL https://opencode.ai/install | bash Менеджеры пакетов npm i -g opencode-ai@latest или bun/pnpm/yarn scoop install opencode Windows choco install opencode Windows brew install anomalyco/tap/opencode macOS и Linux рекомендуется, всегда...

CVE-2021-35587

CVE-2021-35587 설명 - CVE-2021-35587용 POC: 쉽게 악용 가능한 취약점으로, HTTP를 통한 네트워크 접근이 가능한 인증되지 않은 공격자가 Oracle Access Manager를 손상시킬 수 있습니다. - 2022-03-14에 antx가 작성함. 상세 - Oracle Fusion Middleware의 Oracle Access Manager 제품구성 요소: OpenSSO Agent의 취약점. - 쉽게 악용 가능한 취약점으로, HTTP를 통한 네트워크 접근이 가능한 인증되지 않은 공격자가...

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

PYSEC-2026-4055 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

CVE-2024-4956-Sonatype-Nexus-Repository-Manager

CVE-2024-4956-Sonatype-Nexus-Repository-Manager Sonatype Nexus Repository Manager предоставляет централизованную платформу для хранения артефактов сборки CVE-2024-4956 представляет собой уязвимость обхода пути path traversal в Sonatype Nexus Repository manager, которая позволяет злоумышленнику...

CVE-2020-10199

CVE-2020-10199 PT를 진행하던 중 대상 환경에 Nexus Repository Manager가 구축되어 있는 것을 만났고, 여러 시행착오를 겪은 끝에 결국 Shell을 획득할 수 있었다. 나중에 참고할 수 있도록 간단히 기록해 둔다. 대상 버전: Sonatype Nexus Repository Manager OSS 3.20.1-01 PoC로 Code Execution을 테스트하여 취약점이 존재함을 확인했다. 참고: 이때는 로그인된 세션 상태였다. 마침 대상 환경에서 default credential 문제를 발견했기...

CVE-2026-79896

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boksportmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boksportmux. Although the daemon is normally restarted automatically, repeated requests can...

CVE-2026-12627

Fortra's Core Privileged Access Manager BoKS contains a stack-based buffer overflow vulnerability in boksautoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing...

Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution

Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution - Ошибка Cisco: CSCur90888 Название эксплойта : Cisco UCS Manager - 2.21d - Удалённое выполнение команд Описание : Неуказанный CGI-скрипт в Cisco FX-OS до 1.1.2 на устройствах Firepower 9000 и Cisco Unified Computing System UCS Manager до 2.24b,...

tinyfilemanager-2.4.3-exploit

CVE-2021-45010 Tiny File Manager-2.4.3 эксплойт Уязвимость обхода пути Path Traversal в функциональности загрузки файлов в tinyfilemanager.php в Tiny File Manager Project's Tiny File Manager = 2.4.6 позволяет удалённым злоумышленникам с действительными учётными записями пользователей загружать...

CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability

Fortra's Core Privileged Access Manager BoKS contains a stack-based buffer overflow vulnerability in boksautoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing...

CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability

Fortra's Core Privileged Access Manager BoKS contains a stack-based buffer overflow vulnerability in boksautoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing...