libXi: Out-of-bounds read in libXi's XQueryDeviceState()

A flaw was found in libXi. An out-of-bounds read vulnerability in the XQueryDeviceState function allows a malicious X server to trigger an application crash. By returning a specially crafted response to a device state query, the server causes the client application to read memory beyond allocated...

libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser

A flaw was found in libXi. An out-of-bounds read vulnerability in the X Input 2 XI2 class parser allows a malicious X server to cause a Denial of Service DoS by crashing connected client applications. When an application receives and processes specially crafted input from the server, insufficient...

libXi: libXi: Denial of Service via out-of-bounds read in XIQueryDevice reply parsing

A flaw was found in libXi. This out-of-bounds read vulnerability allows a malicious X server to cause a Denial of Service DoS against attached client applications. By returning a specially crafted response to an XIQueryDevice request, the server triggers an invalid memory read within the client,...

libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()

A flaw was found in libXi. An out-of-bounds read vulnerability exists in the XListInputDevices function during the parsing of input device classes. A malicious X server can exploit this flaw by returning crafted device information, causing an attached X client application to crash and resulting i...

libXi: libXi: Denial of Service via out-of-bounds read during XI2 class parsing

A flaw was found in libXi. An out-of-bounds read vulnerability occurs during the parsing of X Input Extension XI2 device class data. A malicious X server can exploit this vulnerability by sending specially crafted class responses to a connected client application. This causes the client to read...

libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()

A flaw was found in libXi. An out-of-bounds read vulnerability in the XListInputDevices function allows a malicious X server to crash connected client applications. By returning specially crafted input device data when a client requests device information, the server can trigger an application...

CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

CVE-2026-85750

Versions of Piwigo prior to v16.4.0 are vulnerable to arbitrary file read and remote code execution (RCE) during image upload handling when utilizing the Imagick library . The root cause is insufficient validation and unsafe processing of user-supplied image files. Specifically, an attacker can e...

EUVD-2026-87094

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

CVE-2026-56718

CVE-2026-56718 jdbhttpd/0.1.0AJCloud AJY IPC 펌웨어의 인증되지 않은 경로 탐색 취약점으로, 원격에서 루트 권한으로 임의 파일을 읽을 수 있으며, 평문 RTSP 자격 증명도 포함됩니다. CWE: CWE-22제한된 디렉토리의 경로명에 대한 부적절한 제한 심각도: CVSS 4.0 - 8.7높음 영향 대상: AJCloud AJY IPC 펌웨어 01.10715.11.37 크레딧: Alessandro Ciotti발견자, VulnCheck조정자 요약 jdbhttpd는 웹 루트 외부로의 ../ 탐색을 차단...

EUVD-2026-87092

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834

A use-after-free vulnerability exists in the QEMU 9pfs subsystem due to a race condition between the main thread and a worker thread. When processing concurrent Tlcreate and Twalk requests, a malicious guest user can craft a fid path containing stale heap data . This allows the attacker to bypass...

CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2025-68493

CVE-2025-68493 CVE-2025-68493 7. 참고 자료 1 ApacheStrutsXWorkXML 취약점 CVE-2025-68493 PoC 및 스크립트 | ZONE.CI 글로벌. https://zone.ci/secarticles/wx/486533.html 8. 취약점 검증 및 활용 CVE-2025-68493 취약점을 검증하고 악용하기 위해, 아래에 제공된 Python PoC 스크립트와 Nuclei YAML 템플릿을 사용할 수 있습니다. 8.1 Python PoC 스크립트 사용 방법 스크립트 이름 :...

CVE-2026-66491

PhocaCommander の getSource を介した任意ファイル読み取り PhocaCommander ≤ 6.1.3 — 認証済み管理者によるパストラバーサル、CSRF 不要 概要 PhocaCommander のファイルエディタエンドポイントには、任意ファイル読み取りの脆弱性が存在します。getSource 関数は、base64 エンコードされた filename パラメータをデコードし、パス包含チェックなしで直接 filegetcontents に渡します。認証済み管理者は、GET リクエストを送信するだけで、Web...

cve-2026-85706

cve-2026-85706 GitLab CE/EE의 인증되지 않은 임의 로컬 파일 읽기 취약점. 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1 버전에 영향을 미친다. 19.1.8 / 19.2.6 / 19.3.2에서 수정됨 2026-09-10. CVSS 10.0, 실제 공격에서 악용된 것으로 보고됨. 최초 보고는 s3ntago가 했으며 이 저장소는 단지 나의 분석 글 + PoC일 뿐이다. 면책 조항 이 PoC는 교육 및 방어적 연구 목적으로만 공개되었으며, 관리자와 연구자가 취약점을 이해하고 테스트하...

cve-2024-30350-research-notes

CVE-2024-30350 연구 노트 개요 CVE-2024-30350은 Foxit PDF Reader의 범위를 벗어난 읽기out-of-bounds read 정보 노출 취약점입니다. 이 문제는 Trend Micro Zero Day Initiative에 의해 ZDI-24-333으로 공개되었으며, 공개 전에는 ZDI-CAN-22708로 추적되었습니다. 공개 권고문은 취약한 영역을 Foxit PDF Reader의 Annotation 객체 처리로 설명합니다. 조작된 PDF는 애플리케이션이 할당된 버퍼의 끝을 넘어 읽도록 만들 수 있습니...