290095 matches found
CVE-2026-59733
A flaw was found in Rclone. When using the rclone serve restic --private-repos command, an authenticated user can include directory traversal sequences e.g., .. in a request. This allows them to bypass authorization and read, overwrite, or delete another user's private repository on backends that...
Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)
Overview On July 14, 2026, SonicWall published a security advisory addressing two vulnerabilities affecting SMA1000 Series remote access appliances, including the critical server-side request forgery SSRF vulnerability CVE-2026-15409 CVSS 10.0 and the high-severity code injection vulnerability...
bug-bounty-toolkit
Bug Bounty Toolkit Automated reconnaissance-to-triage pipelin...
CVE-2026-46709
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $… and …, so the incomplete CVE-2026-45038 fix for...
Exploit for CVE-2026-58138
CVE-2026-58138: Conductor unauthenticated RCE Reproduction ki...
Security update for docker
This update for docker rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...
Security update for buildah
This update for buildah rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...
CVE-2026-46709 Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $… and …, so the incomplete CVE-2026-45038 fix for...
CVE-2026-46709 Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $… and …, so the incomplete CVE-2026-45038 fix for...
EUVD-2026-44692
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $… and …, so the incomplete CVE-2026-45038 fix for...
CVE-2026-46709
Tabby (Terminus) prior to 1.0.234 is vulnerable to a local RCE via drag-and-drop path injection. The vulnerability occurs because Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters (e.g., $(…) and …)....
CVE-2026-46709 Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $… and …, so the incomplete CVE-2026-45038 fix for...
Web-Attack-Log-Analysis
🛡️ Module A — Web Attack Simulation Simulate six real-world...
lpd-shell-injection
LPD Shell Injection — RCE Exploit RFC 1179 A precision Pyth...
Digital-Archiving-Solutions-v1.02-RCE
LPD Shell Injection — RCE Exploit RFC 1179 A precision Pyth...
Command Injection
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...
Malicious code in xyq-drama-skill (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ea591e5b995503deb15b174a37fc7af37cb5987a6c3d715d256fe0c3bfe10 setup.py registers a custom install cmdclass that, on pip install, downloads an opaque binary from...
MAL-2026-10681 Malicious code in xyq-drama-skill (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ea591e5b995503deb15b174a37fc7af37cb5987a6c3d715d256fe0c3bfe10 setup.py registers a custom install cmdclass that, on pip install, downloads an opaque binary from...
Lanflux
Lanflux On-LAN recon and exploitation after wireless footho...
K000161834: NGINX Ingress Controller vulnerability CVE-2026-52865
Security Advisory Description When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. CVE-2026-52865 Impact...