594039 matches found
CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...
CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...
CVE-2026-65591
CVE-2026-65591 Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions ...
CVE-2026-39987-Poc
CVE-2026-39987-Poc Proof of Concept PoC WebSocket client for CVE-2026-39987 Marimo Pre-Auth RCE, intended for authorized security testing. β οΈ Disclaimer This script/tool is provided for educational, research, and authorized testing purposes only. It is designed to be used on systems where you have...
POC-CVE-2025-55182
CVE-2025-55182 - React RSC RCE PoC for the deserialization vulnerability in the Flight protocol of React Server Components. What is it? Next.js 14+ and React 19 use a proprietary protocol "Flight" to communicate between client and server. The problem: the server loads any module without...
CVE-2022-31814
Download CVE-2022-31814 This script exploits a vulnerability in pfSense to upload a shell, execute a command, and then delete the shell. Requirements Python 3.x requests library Installation 1. Clone the repository or download the script. 2. Install the required Python libraries: pip install...
CVE-2026-64824-PoC
CVE-2026-64824 β Home Assistant Core Backup-Restore Symlink Path Traversal β RCE CVSS 8.4 Critical Β· GHSA-cwh8-w64c-4j5h Β· CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...
Blackash-CVE-2025-61757
π¨ CVE-2025-61757 β Pre-Auth RCE Alert π¨ 𧩠Summary ID: CVE-2025-61757 Product: Oracle Identity Manager Oracle Fusion Middleware Component: REST WebServices Affected Versions: 12.2.1.4.0 & 14.1.2.1.0 Severity: π΄ Critical β 9.8 CVSS 3.1 Published: Oct 21, 2025 Type: Missing Authentication for Critic...
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Summary Langflow OSS is affected by multiple vulnerabilities involving code-execution restrictions, access controls, sensitive-data handling, file access, and archive processing. Depending on deployment configuration, an attacker could execute code, read or modify data without authorization,...
CVE-2026-15409
π CVE-2026-15409 β SonicWall SMA 1000 Erlang RCE via WebSocket Proxy ProofβofβConcept exploit for CVE-2026-15409 β unauthenticated remote code execution on SonicWall SMA 1000 series appliances via the Erlang distribution protocol tunneled over WebSocket. π Overview CVE-2026-15409 is a critical...
CVE-2026-104849
The Tinypool Node.js worker thread pool implementation (prior to version 2.1.2 ) is vulnerable to a prototype pollution gadget. The issue arises because pool.run(task, options) reads the filename property from a caller-supplied options object without requiring an own property . If an attacker pol...
VulnHub-DC1-Writeup
VulnHub-DC1-Writeup "Penetration testing lab writeups documenting full attack chains β from recon to root." π VulnHub β DC-1 Boot-to-Root Writeup Difficulty: BeginnerβIntermediate Platform: VulnHub Goal: Capture all 4 flags and achieve full root-level compromise Attacker OS: Kali Linux VirtualBox...
CVE-2026-51911
vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...
CVE-2026-104846
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...
DEBIAN-CVE-2026-103631
Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-103631
Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
DEBIAN-CVE-2026-103630
Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-103630
Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
DEBIAN-CVE-2026-103623
Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-103623
Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...