Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

CyberPanel - Command Injection

CyberPanel contains a command injection vulnerability in the /ftp/getresetstatus and /dns/getresetstatus endpoints.The vulnerability exists due to improper validation of the 'statusfile' parameter, which is directly used in a shell command.The security middleware only validates POST requests,...

CVE-2026-106414

A flaw was found in Google Chrome on iOS. Improper input validation allows a remote attacker to achieve arbitrary code execution outside the application sandbox. By using social engineering to convince a user to visit a specially crafted HTML page, an attacker can exploit this vulnerability to...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

EUVD-2026-94154

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-102478

In affected versions of Octopus Server , an authenticated user with permissions to modify roles can achieve privilege escalation . The vulnerability is caused by the improper validation of unsafe equivalence in inputs , allowing an attacker to weaken built-in roles and add their account to a priv...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-97673

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...

CVE-2026-97679

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command 'Code Injection' related to improper input validation...

CVE-2026-97678

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...

CVE-2025-69822-Atomberg_Erica_SmatFan_Security_Assessment

CVE-2025-69822-AtombergEricaSmatFanSecurityAssessment 该漏洞影响Atomberg Erica Smart Fan（固件版本1.0.36）的设备可用性和可靠运行。该问题的出现是由于缺乏针对伪造取消认证帧的保护机制，且设备缺少回退或重新连接验证。 该漏洞的概念验证（PoC）记录在附件PDF中，该PDF最初是为了内部安全审查而提供给相关组织的。 发现者 - CipherX1802...

CVE-2025-56499

CVE-2025-56499 通过本地规则提供者中缺失的路径验证实现任意文件读取 上游修复：https://github.com/MetaCubeX/mihomo/pull/2177 受影响版本：mihomo = v1.19.11 摘要 在解析 rule-providers 配置时，type = "file" 分支未能对提供的路径进行验证。通过身份验证的攻击者控制 schema.Path 后，可以将提供者指向任何可读的本地文件。由于大多数任意文件不符合预期的规则格式，解析错误（包括大量文件内容片段）会引入内存日志，并通过 /logs API 暴露。由于 mihomo...

roundcube-cve-2025-49113-lab

DESCARGO DE RESPONSABILIDAD: Solo para uso educativo Laboratorio de RCE en Roundcube Webmail – CVE-2025-49113 Este repositorio documenta mi explotación paso a paso de Roundcube Webmail CVE-2025-49113 en un laboratorio controlado para obtener el secreto almacenado en /secret.txt. ⚠️ Descargo de...

CVE-2026-97673 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...

CVE-2026-97673 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...

CVE-2026-97673

The Langflow OSS software versions 1.0.0 through 1.12.2 are affected by CVE-2026-97673 , which allows a remote authenticated attacker to execute arbitrary code due to improper input validation (CWE-693 ). This vulnerability can lead to high impact on confidentiality, integrity, and availability. ...

EUVD-2026-94121

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...

PT-2026-107679

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

CVE-2026-106353

Improper input validation in Mobile in Google Chrome on on iOS prior t...

Linux Distros Unpatched Vulnerability : CVE-2026-106343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML...