Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

GHSA-96H4-VGXJ-GVM2 Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

Important: Red Hat Security Advisory: pcp security update

An update for pcp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

CVE-2026-0596-Reproduction

CVE-2026-0596: MLflow 에코시스템의 안전하지 않은 역직렬화를 통한 임의 코드 실행 mlflow==2.11.1 및 mlserver==1.3.5 내 신뢰할 수 없는 모델 로딩 파이프라인과 관련된 검증, 기본 메커니즘 및 아키텍처 취약점을 상세히 설명하는 포괄적인 보안 연구 보고서입니다. ⚠️ 취약점 인텔리전스 권고: CVE-2026-0596 항목| 세부 정보 ---|--- 취약점 ID| CVE-2026-0596 / GHSA-rvhj-8chj-8v3c 공통 취약점 열거CWE| CWE-78: OS 명령에 사용되는 특수...

CVE-2025-9074

CVE-2025-9074: Docker Engine API 무인증 원격 코드 실행 RCE 심각도 : CRITICAL | CVSS 점수 : 9.8 추정 | 영향받는 버전 : Docker Desktop 4.44.3 CVE-2025-9074에 대한 개념 증명POC 익스플로잇으로, Docker Engine API의 무인증 원격 코드 실행RCE 취약점을 통해 권한 있는 컨테이너 탈출과 호스트 시스템 장악을 허용합니다. 🔴 취약점 개요 CVE-2025-9074는 적절한 인증이나 네트워크 격리 없이 Docker Engine API를 노출하...

CVE-2022-22954

CVE-2022-22954 PoC VMware Workspace ONE Access 및 Identity Manager의 SSTI를 통한 RCE. CVE-2022-22954 - PoC SSTI 사용법: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file | manual -i IP, --i...

CVE-2026-93995

A flaw was found in Apache MINA SSHD. The sshd-git module does not properly restrict command-line arguments when executing Git commands over Secure Shell SSH connections. An authenticated remote attacker can exploit this issue by providing a crafted output parameter during an archive operation...

Exploit for CVE-2026-102971

CVE-2026-102971: hidden revision author ID disclosure Reporte...

Security update for jawn

This update for jawn fixes the following issue: CVE-2026-61814: quadratic rescan complexity in AsyncParser can cause excessive CPU resource exhaustion bsc1282548. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for multipath-tools

This update for multipath-tools fixes the following issues: Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. Path traversal in device-mapper-multipath failedwwids management bsc1277210. SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows bsc127721...

CVE-2026-82307

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1...

EUVD-2026-89963

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29...

CVE-2026-18782 SQL Injection in Trex Digital Manufacturing's Trex MES

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29...

CVE-2026-18782

The Trex MES software by Trex Digital Smart Manufacturing Systems Inc. contains an SQL injection vulnerability due to the improper neutralization of special elements in SQL commands. This flaw is severe enough to allow Command Line Execution via the SQL injection vector. The vulnerability affects...

CVE-2026-62097

The WPTasty Business Directory plugin for WordPress (versions n/a through 6.4.27 ) is vulnerable to Blind SQL Injection due to the Improper Neutralization of Special Elements used in an SQL Command . This flaw allows an attacker with high privileges to execute malicious SQL queries. No specific e...

CVE-2026-62097 WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27...

EUVD-2026-89957

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27...

Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570 , an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notificatio...

Drupal_REST-RCE_Unauthenticated

CVE-2019-6340 — Drupal RESTful 웹 서비스 RCE CVE-2019-6340에 대한 원격 코드 실행 익스플로잇의 Python 구현으로, Metasploit 모듈 분석 및 leonjza의 선행 연구에 기반합니다. EDB-46459와의 주요 차이점: GET 대신 POST를 사용하여 Drupal의 페이지 캐시를 우회합니다. 따라서 캐시 만료를 기다리지 않고 동일한 대상에 대해 여러 번 실행할 수 있습니다. 요구 사항 pip install requests 사용법 python3 exploit.py -c option...