ALSA-2026:72424 Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fixes: resteasy-core: RESTeasy SourceProvider remote unauthenticated file read...

CVE-2019-19203

CVE-2019-19203 An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function gb18030mbcenclen in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read. Researcher: ManhND of The Tarantul...

CVE-2024-23897

Read first 3 lines of any file with read permission for current user on the system. The script is using proxychains internally. Usage: python CVE-2024-23897.py Example: python CVE-2024-23897.py /mnt/hgfs/Share/jenkins-cli.jar http://10.10.14.8:8080/ /var/lib/jenkins/secrets/master.key...

CVE-2024-57785

CVE-2024-57785 Exploit Title: Authenticated File Inclusion Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57785 Usage: CVE-2024-57785.py -h -u URL -f FILE optional arguments: -h, --help...

CVE-2024-38819-POC2

CVE-2024-38819: Proof of Concept PoC This is a proof of concept for the CVE-2024-38819 vulnerability, which I reported, demonstrating a path traversal exploit. Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 cd vuln docker build -t cve-2024-38819-poc...

CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

DEBIAN-CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-78938

CVE-2026-78938 — V8 TurboFan CheckMaps type confusion при миграции экземпляров Анализ первопричины и эксплойт для CVE-2026-78938, type confusion в устранении загрузок TurboFan в V8, исправленная в Chrome 152.0.7977.64 V8 15.2.124.18. Ошибка была зарегистрирована как эксплуатируемая в реальных...

CVE-2020-1938

CVE-2020-1938 CVE-2020-1938 fixes errors in the PoC from https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat.git and has been verified to work on Apache Tomcat/8.0.43. Practice Steps 1. Create docker-compose.yml 2. docker compose up -d 3. python3 CVE-2020-1938.py -p 8009 ...

CVE-2026-85706-gitlab-poc

CVE-2026-85706 Описание Уязвимость неаутентифицированного произвольного чтения файлов в GitLab CE/EE CVE-2026-85706. Уязвимые версии: GitLab CE/EE 18.7 – 19.1.7 GitLab CE/EE 19.2.0 – 19.2.5 GitLab CE/EE 19.3.0 – 19.3.1 Исправленные версии: GitLab 19.1.8 GitLab 19.2.6 GitLab 19.3.2 Детали уязвимос...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI Author: 0xmid00 Vulnerability: SSRF / Local File Read via XOP:Include in MTOM requests Affected: Apache CXF 3.5.5 and 3.4.10 What is the Vulnerability? Apache CXF processes MTOM Message Transmission Optimization Mechanism messages that contain...

CVE-2026-96284 Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-96284 Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-96284

The Flatpak utility is vulnerable to a flaw where the OCI code paths in the system-helper context follow symlinks when importing OCI images. A malicious user who controls the OCI image can exploit this to gain arbitrary read-access to files within the flatpak-system-helper context, provided a sys...

CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2025-14847

CVE-2025-14847 Description CVE-2025–14847, also known as MongoBleed, is a vulnerability that allows attackers to perform unauthorized data reads from the heap memory space of the server on which the MongoDB database runs, without authentication. How to Reproduce podman-compose vuln-machine/ up -d...

CVE-2026-101063

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

cve-writeups-and-pocs

CVE-2026-80724 PoC и технический разбор CVE-2026-80724 — ядро Linux ptp: vmclock: предотвращение превращения отображаемых только для чтения областей в доступные для записи Полный Proof-of-Concept + технический разбор Исследование безопасности от Abdifatah Suruur suruur — коллекция разборов CVE и...

CVE-2023-52356-libtiff-analysis

CVE-2023-52356 – Анализ TIFFReadRGBATileExt в libtiff Обзор В этом лабораторном анализе рассматривается CVE-2023-52356 в libtiff, с акцентом на поведение TIFFReadRGBATileExt при получении координат изображения, выходящих за допустимые границы. Анализ включает воспроизведение исходного сбоя, отлад...

-INE_Shivam_Gupta_23104003

CVE-2021-43798 — Лаборатория неаутентифицированного обхода пути в Grafana Только для образовательных целей. Запускайте эту лабораторию только на изолированной локальной машине. Никогда не выставляйте её в интернет. Сводка по CVE Поле| Детали ---|--- CVE ID| CVE-2021-43798 Продукт| Grafana Уязвимы...