Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

Version_Vulnerability_Scanner

لا يحتوي هذا المستودع على ملف README...

CVE-2024-41110-SCAN

CVE-2024-41110 डॉकर सुरक्षा जांचकर्ता यह उपकरण डॉकर इंस्टॉलेशन में CVE-2024-41110 से संबंधित कमजोरी की जांच के लिए डिज़ाइन किया गया है। यह विशेष रूप से डॉकर के कमजोर संस्करणों और AuthZ प्लगइन्स के उपयोग की खोज करता है, जो संभावित रूप से सुरक्षा समस्याओं का कारण बन सकते हैं। उपयोग निम्नलिखित कमांड...

CVE-2021-22205

CVE-2021-22205 Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 Uso: root@kitploit: Verificar vulnerabilidade: python 22205exp.py -u url -v Executar comando: python 22205exp.py -u url -c command Verificação em lote: python 22205exp.py -f filename Referência: root@kitploit:...

EUVD-2026-37013

gRPC Erlang package's path bindings are overridable by query string and request body...

CVE-2026-78270

An Author SQL Injection vulnerability affects the WordPress FluentCRM Pro plugin in versions 3.1.12 and below . Discovered by Ananda Dhakal (Patchstack), the flaw requires a high-privilege user to exploit (CVSS 7.6 HIGH , vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), yielding high confidentiality ...

UBUNTU-CVE-2026-63385

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

CVE-2026-54787 affecting package gh for versions less than 2.97.0-1

CVE-2026-54787 affecting package gh for versions less than 2.97.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-18938 affecting package p11-kit for versions less than 0.26.5-1

CVE-2026-18938 affecting package p11-kit for versions less than 0.26.5-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-73072 affecting package vim for versions less than 9.2.0957-1

CVE-2026-73072 affecting package vim for versions less than 9.2.0957-1. An upgraded version of the package is available that resolves this issue...

EUVD-2026-57740

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-13227

CVE-2026-13227 affects ERPNext prior to version 15.115.0 and prior to 16.25.0, due to improper authorization in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. The root cause is insufficient access control on this API, enabling inappropriate disclosure or manip...

CVE-2026-47746

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and...

CVE-2026-67315 axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NOPROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local...

EUVD-2026-51426

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

MongoDB 8.0.x < 8.0.28 Aggregation Command Invariant Assertion Failure (SERVER-128512)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28. It is, therefore, affected by a vulnerability: - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of...

JLSEC-2026-808 Integer overflow in OpenEXR's `internal_dwa_compressor`

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, internaldwacompressor.h:1040 performs chan-width chan-bytesperelement in...

BIT-THRIFT-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

DRUPAL-CONTRIB-2026-088

The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters. The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery...

CVE-2025-32781 Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...