MAL-2026-17613 Malicious code in utxo-set-utils (RubyGems)

RubyGems runs this gem's native extension script ext/utxo-set-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

dockerevil

dockerevil مستودع بسيط لتخزين ثغراتي الأمنية في تقنية docker 2016 - 2017 تصعيد الامتيازات عبر Docker APILPE/RPE تصعيد الامتيازات من الخادم غير المتصل/الصور المصغّرة/البناء من Dockerfile بصيغة TAR تصعيد الامتيازات عبر Docker SUDO PoC سكربتات Nmap 2019 استغلال مبني على CodeStudent1995 تصعيد...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

EUVD-2026-92275

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 is vulnerable to remote code execution (RCE) due to a directory traversal flaw in the /api/documents/upload endpoint. A standard user can exploit this to write a Python .pth file into the site-packages directory. The malicious code within the .pth file is executed automatically d...

Malicious code in web3-sign-helper (RubyGems)

RubyGems runs this gem's native extension script ext/web3-sign-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17617 Malicious code in web3-sign-helper (RubyGems)

RubyGems runs this gem's native extension script ext/web3-sign-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

LGPwn

LGPwn استغلال صلاحيات الجذر لأجهزة LG المؤلف: [email protected] شكر خاص: جوجي، لإشارته إلى ملف ثنائي غريب في تحديث spritebud، وهو ما قادني إلى اكتشاف هذه الثغرة. الموضوع: حالة سباق Race condition في برنامج النسخ الاحتياطي لشركة Sprite Software، المثبّت من قِبل المُصنّع الأصلي OEM على أجهزة L...

CVE-2025-56819

CVE-2025-56819 Datart v.1.0.0-rc.3 में एक समस्या है जो दूरस्थ हमलावर को INIT कनेक्शन पैरामीटर के माध्यम से मनमाना कोड निष्पादित करने की अनुमति देती है। POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider",...

DEBIAN-CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

UBUNTU-CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

UBUNTU-CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...

Oracle-Identity-Manager-CVE-2025-61757

Oracle Identity Manager CVE-2025-61757 भेद्यता पहचान उपकरण v2.2 🔥 भेद्यता पृष्ठभूमि हाल ही में, Oracle Identity Manager में एक गंभीर रिमोट कोड निष्पादन भेद्यता CVE-2025-61757 सामने आई है। यह भेद्यता SecurityFilter द्वारा अनुरोध URI के अनुचित प्रसंस्करण के कारण उत्पन्न हुई है। हमलावर ;.wadl पैरामी...

CVE-2026-6279.py

विवरण यह पायथन स्क्रिप्ट CVE-2026-6279 के लिए एक शोषण उपकरण है जो Avada Builder = 3.15.2 को लक्षित करता है। मुख्य व्यवहार: Avada-विशिष्ट शॉर्टकोड/पेज पैटर्न के माध्यम से fusionloadnonce के लिए लक्ष्यों को स्कैन करता है AJAX एंडपॉइंट और मूल IP बायपास की खोज करता है यदि Cloudflare admin-ajax को ब्ल...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI 'Insert Prompt as Rich Text' सक्षम होने पर प्रॉम्प्ट के माध्यम से स्टोर्ड DOM XSS के लिए असुरक्षित है, जिसके परिणामस्वरूप ATO/RCE होता है। सारांश जब 'Insert Prompt as Rich Text' सक्षम होता है, तो चैट विंडो में कस्टम प्रॉम्प्ट सम्मिलित करने वाली कार्यक्षमता DOM XSS के...

Malicious code in eth-address-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...