Exploit-Chain-Suggestor

Exploit Chain Suggestor A CLI tool for penetration testers an...

Exploit-Chain-Suggester

Exploit Chain Suggester v2.0.0 A CLI tool for penetration tes...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53839 via openclaw (>=2026.3.22, <=2026.5.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53839 Source advisory: OSV:GHSA-77Q5-RR5V-X43Q...

jchain-static

jChain-Static Vulnerability Chain Playbook Generator for Pe...

CVE-2026-49478 vulnerabilities

Vulnerabilities for packages: buildah, skopeo, kyverno, undock, kots, kubescape, zarf, podman, aactl, tekton-chains, witness, falcoctl, ratify, falco-no-driver, slsa-verifier, kyverno-notation-aws, flux-source-controller, gitsign...

GHSA-F5MR-Q85P-6HH6 vulnerabilities

Vulnerabilities for packages: buildah, skopeo, kyverno, undock, kots, kubescape, zarf, podman, aactl, tekton-chains, witness, falcoctl, ratify, falco-no-driver, slsa-verifier, kyverno-notation-aws, flux-source-controller, gitsign...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

EUVD-2026-40388

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including...

Linux Distros Unpatched Vulnerability : CVE-2026-6091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An...

CVE-2026-53404

The Apache Tomcat rewrite valve contains an Always-Incorrect Control Flow Implementation vulnerability (CVE-2026-53404 ). Due to this flaw, if the first condition in an OR chain matches, subsequent non-OR conditions are skipped, which can allow an attacker to circumvent access control restriction...

Linux Distros Unpatched Vulnerability : CVE-2026-53138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Bound VBIOS record-chain walk loops Why & How All record-chain walk loops in biosparser.c and biosparser2.c use for;; and only terminate on a...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi-fips, prometheus, syft-fips, crossplane-provider-aws-rolesanywhere-fips, rootlesskit, crossplane-provider-aws-organizations-fips, vitess, crossplane-provider-aws-cloudformation, crossplane-provider-aws-redshiftserverless-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi-fips, prometheus, syft-fips, crossplane-provider-aws-rolesanywhere-fips, rootlesskit, crossplane-provider-aws-organizations-fips, vitess, crossplane-provider-aws-cloudformation, crossplane-provider-aws-redshiftserverless-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: trivy, docker, k3s, dagger, falcoctl, mattermost, crossplane-provider-azure-storage, argo-events, cosign, buildah, terraform-provider-azurerm, pulumi-kubernetes-operator, tkn, docker-machine-driver-harvester, mods, spire-server, grype, cilium-cli, falco-no-driver, ag...

RockyLinux 9 : buildah (RLSA-2026:29455)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:29455 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

UBUNTU-CVE-2026-6091

Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An attacker could present a chain that ends at an intermediate they control and have it accepted as valid. This affects the OpenSSL...

CVE-2026-6091 Partial-chain verification accepts untrusted intermediate as trust anchor

Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An attacker could present a chain that ends at an intermediate they control and have it accepted as valid. This affects the OpenSSL...

OPENSUSE-SU-2026:21159-1 Security update for python-py7zr

This update for python-py7zr fixes the following issues: Changes in python-py7zr: - CVE-2026-23879: crafted malicious symbolic link chains in an archive can lead to an arbitrary file write bsc1268669 - CVE-2026-55195: unchecked extraction size can cause a denial of service bsc1268665 -...

DEBIAN-CVE-2026-23879

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Versions 1.1.2 and below contain an an arbitrary file write vulnerability, which allows symbolic links to be recreated outside the destination directory via crafted malicious...

CVE-2026-23879 py7zr: Arbitrary File Write Vulnerability

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Versions 1.1.2 and below contain an an arbitrary file write vulnerability, which allows symbolic links to be recreated outside the destination directory via crafted malicious...