CVE-2025-12399

Alex Reservations: Smart Restaurant Booking = 2.2.3 - Caricamento arbitrario di file autenticato: Admin+ Il plugin WordPress Alex Reservations versioni 2.2.3 e precedenti contiene una vulnerabilità di caricamento arbitrario di file che consente agli amministratori WordPress autenticati di caricar...

system_bt_AOSP10_r33_CVE-2021-0507

Stack Bluetooth Fluoride Compilazione ed esecuzione su AOSP Basta compilare AOSP - Fluoride è incluso per impostazione predefinita. Compilazione ed esecuzione su Linux Istruzioni per Ubuntu, testate su 14.04 con Clang 3.5.0 e 16.10 con Clang 3.8.0 Scarica i sorgenti root@kitploit: mkdir /fluoride...

system_bt_AOSP10_r33_CVE-2021-0476

Stack Bluetooth Fluoride Compilazione ed esecuzione su AOSP Basta compilare AOSP - Fluoride è incluso per impostazione predefinita. Compilazione ed esecuzione su Linux Istruzioni per Ubuntu, testate su 14.04 con Clang 3.5.0 e su 16.10 con Clang 3.8.0 Scarica il codice sorgente root@kitploit: mkdi...

system_bt_AOSP10_r33_CVE-2021-0435

Stack Bluetooth Fluoride Compilazione ed esecuzione su AOSP È sufficiente compilare AOSP: Fluoride è incluso per impostazione predefinita. Compilazione ed esecuzione su Linux Istruzioni per Ubuntu, testate su 14.04 con Clang 3.5.0 e 16.10 con Clang 3.8.0 Scarica il codice sorgente root@kitploit:...

system_bt_AOSP10_r33_CVE-2021-0431

Stack Bluetooth Fluoride Build ed esecuzione su AOSP Basta compilare AOSP: Fluoride è incluso per impostazione predefinita. Build ed esecuzione su Linux Istruzioni per Ubuntu, testate su 14.04 con Clang 3.5.0 e 16.10 con Clang 3.8.0 Scarica il codice sorgente root@kitploit: mkdir /fluoride cd...

CVE-2026-25747

Reproducer für die LevelDB-Deserialisierungsschwachstelle Dieses Projekt demonstriert eine Java-Deserialisierungsschwachstelle im Apache-Camel-LevelDB-Aggregations-Repository, ähnlich zu CVE-2024-23114 die das Cassandra-Aggregations-Repository betraf. Zusammenfassung der Schwachstelle Eigenschaft...

CVE-2026-39987

CVE-2026-39987 marimo è un notebook Python reattivo. Prima della versione 0.23.0, Marimo presenta una vulnerabilità RCE pre-autenticazione root@kitploit: / | |// / / / / / / |/ |/ \ / | | | \ /| | /| //|/|/ / | | | / -----/ | |/ |/ ----- \ | |/ \ / / / / //// / | |// CVE-2026-39987...

EUVD-2026-67827

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569

aqua (aquaproj/aqua), a declarative command-line version manager written in Go, contains a symlink traversal flaw in pkg/unarchive/archives.go (HandleFile). The handler calls os.Symlink with an unvalidated LinkTarget and does not jail the target to the extraction destination. A subsequent regular...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

EUVD-2026-67819

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288

Stable Diffusion WebUI through version 1.10.1 is affected by a credential disclosure vulnerability in the /sdapi/v1/cmd-flags API endpoint. The endpoint returns parsed command-line arguments—including gradio_auth and api_auth values—in cleartext, allowing unauthenticated network attackers to retr...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - Catena completa n8n Lettura arbitraria di file non autenticata → Forgiatura token admin → Bypass sandbox → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Critico Interessate| = 0.211.0 RCE Corretta| 1.121.0 AFR / 1.120.4+ RCE Divulgat...