CVE-2026-86751

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility

A flaw was found in the gzexe utility of GNU gzip. When the mktemp utility is not available, gzexe creates temporary files with predictable names based on the process ID. A local attacker can exploit this by pre-creating a symbolic link to an arbitrary file at the predicted temporary file path...

Moderate: Red Hat Security Advisory: gzip security update

An update for gzip is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

ChamiloLMS-CVE-2023-4220

ChamiloLMS CVE-2023-4220 漏洞利用工具 Python 漏洞利用脚本，针对 CVE-2023-4220 ，这是一个影响 Chamilo LMS = 1.11.24 的未经认证的任意文件上传漏洞。 该漏洞位于 Chamilo 的 BigUpload 组件中。在易受攻击的安装中，上传处理程序允许在没有适当验证的情况下上传 PHP 文件。由于上传的文件存储在 Web 可访问的目录中，如果启用了 PHP 执行，上传的 PHP 文件可以直接被请求并用作 webshell。 此仓库包含两个版本的漏洞利用脚本： root@kitploit:...

WinRAR-CVE-2025-8088-Exploitation-Toolkit

☠️ CVE-2025-8088 WinRAR 漏洞利用工具 ☠️ 系统访问：已授权 目标：WINRAR 漏洞 一款精密、军事级 GUI 工具，专用于创建恶意 RAR 压缩包，利用 WinRAR 路径遍历漏洞（CVE-2025-8088）。该工具利用先进的 NTFS 备用数据流（ADS）和 RAR5 头部操作来绕过安全控制机制。 ⚡ 系统能力 + ADS 隐身技术 ：利用 NTFS 备用数据流隐藏载荷。 + 头部注入 ：直接操作 RAR5 头部以实现精确的路径遍历。 + 自动持久化 ：自动针对 Windows 启动项部署以实现持久化。 + 诱饵操作 ：支持自定义诱饵文件以保持隐蔽性。 🛠️...

CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-86775

CVE-2026-86775 affects the knowns npm package (versions ≤ 0.29.1) with a path traversal vulnerability in the Document API. The root cause lies in cleanDocPath() in internal/server/routes/docs.go, which strips leading/trailing slashes and the .md suffix but fails to neutralize ../ sequences, and i...

EUVD-2026-74952

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86751

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in checkout acceptance note fields. The unsanitized syntax survives HTML escaping, is expanded by the CommonMark parser, and is resolved by laravel-mail-auto-embed via file_get_contents or curl. This allows authenticated users...

CVE-2026-86741

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML tags pointing to local files or remote URLs, which the mail auto-embed library r...

CVE-2026-86741 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

CVE-2026-86741 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

CVE-2025-8110

CVE-2025-8110 - Bypass de symlink en Gogs - escritura arbitraria de archivos como el usuario del proceso Gogs Gogs //contents/. Gogs sigue el symlink y escribe bytes controlados por el atacante en el destino del enlace con los privilegios del proceso Gogs. Cuando Gogs se ejecuta como root, esto e...

WordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'type' Parameter vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Drag and Drop File Upload for Elementor Forms versions = 1.6.0...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - Cadena completa n8n Lectura arbitraria de archivos sin autenticación → Forja de token de administrador → Evasión de sandbox → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Crítico Afectado| = 0.211.0 RCE Corregido| 1.121.0 AFR /...

CVE-2026-23745

CVE-2026-23745: Sobrescritura Arbitraria de Archivos en node-tar Investigación: Joshua van Rijswijk Descripción PoC para CVE-2026-23745 , una vulnerabilidad de traversal de rutas de alta severidad en node-tar 7.5.2. La librería no sanitiza rutas absolutas en el campo linkpath para Hardlinks y...

CVE-2026-21436

CVE-2026-21436 eopkg = 4.3.4, el gestor de paquetes de Solus OS, escribe directamente en el directorio especificado los archivos que contienen rutas absolutas dentro del contenido del paquete durante la instalación de paquetes con extensión .eopkg. Incluso si se utiliza el parámetro --destdir,...