EUVD-2026-89681

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

POC-CVE-2025-24813

CVE-2025-24813 Apache Tomcat RCE PoC Proof of Concept PoC exploiting CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability allows an attacker to upload a malicious serialized payload to the server, leading to arbitrary code execution via deserialization whe...

CVE-2010-1240

CVE-2010-1240 - Embedding backdoor into a PDF ⚠️ For educational and authorized security research purposes only Description Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog,...

CVE-2026-92867

An out-of-bounds write vulnerability exists in Pgpool-II , which could allow an authenticated attacker to cause abnormal process termination or achieve arbitrary code execution . While technical details regarding the specific root cause or affected versions are not provided in the documents, the ...

CVE-2026-97977

A flaw was found in the Linux kernel's Bluetooth USB driver. A race condition during device closure or disconnection allows background receive tasks to continue running after the associated device data has been released, leading to a use-after-free UAF condition. A local attacker could exploit th...

CVE-2020-24972

So CVE-2020-24972 spans from another cve in actually. I don't remember the cve that got designated but it has to do with platformpluginpath cmdline option from qt. So in essence the problem comes from using qt, persee the option platformpluginpath . "This parameter is supposed to contain a...

CVE-2026-102331

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside of the application sandbox via a buffer overflow in the ANGLE Almost Native Graphics Engine component. An attacker could exploit this vulnerability by enticing a user to visit a...

Security Bulletin: This Power System update is being released to address CVE-2026-96263

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...

CVE-2026-103111

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...

Security Bulletin: This Power System update is being released to address CVE-2026-96264

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

Security Bulletin: This Power System update is being released to address CVE-2026-96262

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

CVE-2026-102875

A flaw was found in VLC media player. An attacker can achieve arbitrary code execution by convincing a user to open a maliciously crafted skin archive. Because the theme loader fails to properly validate member file paths within the archive, files containing directory traversal sequences can be...

Malicious code in developmentstelemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98ef8863222571a8e77635ed5129c41ad9583d9df4e9e5fd61b5a07c4fb26887 package.json declares scripts.postinstall = 'node index.js'. index.js is a 143-byte stub whose only behavior is to dynamically import the sole declar...

Malicious code in booking-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08305a6c73bd94f2983c949316cb78fef7f7169f85523a773c94fb305874e063 The package's package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The bundled 4444.vbs contains...

CVE-2026-97955

A flaw was found in the Microsoft Azure Network Adapter MANA driver in the Linux kernel. A local user with network administrative privileges can cause a denial of service DoS or potentially execute arbitrary code due to a use-after-free vulnerability. When attaching an eXpress Data Path XDP progr...

git-fsmonitor

This is a documented known issue, but I found this during my research & its pretty useful for RT/PT. Summary: The FSMonitor helper is executed by git on every command like git status, git diff, etc., hence git will blindly launch whatever path we specfic there. Our IDEs runs git status...

Clustering Local File Inclusion

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access. id: CVE-2021-43496 inf...

GRAND FlAGallery 1.57 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in facebook.php in the GRAND FlAGallery plugin flash-album-gallery before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter. id: CVE-2011-4624 info: name: GRAND FlAGallery 1.57 - Cross-Site Scripting...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

Joomla! Portfolio Nexus - Remote File Inclusion

Joomla! Portfolio Nexus 1.5 contains a remote file inclusion vulnerability in the inertialFATE iF comifnexus component that allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2009-4679 info: name: Joomla! Portfol...