47416 matches found
CVE-2026-48749 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...
EUVD-2026-63976
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...
CVE-2026-48749
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...
CVE-2026-48749
Incus, a system container and virtual machine manager, is vulnerable to arbitrary file read and write on the host via a crafted image containing a duplicate top-level rootfs symlink. The root cause is that Incus validates an image upon seeing metadata.yaml and a rootfs/ entry, but later extractio...
CVE-2026-48749 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...
CVE-2026-76233
A flaw was found in Renovate. This command injection vulnerability exists within the gleam manager, where the 'depName' parameter is not properly sanitized when appended to 'gleam deps update' commands. An attacker with repository write access can exploit this by crafting malicious 'gleam.toml'...
Malicious code in scrambleeer (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb0e96b324df04d5ecaf0739dec60dcb2367a26def0e713519c51e24ee790df The package advertises a numeric shuffle utility but its sole public function scrambleeer opens a TCP socket to bax.h4x.tv on port 6363, dup2's the...
CVE-2026-63046
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...
EUVD-2026-63849
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...
MAL-2026-14349 Malicious code in boto4 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa setup.py defines a custom setuptools install command EjecutaElf that base64-decodes a 17MB embedded Linux ELF, writes it to /tmp/.systemd-helper,...
Splunk Enterprise’s vulnerabilities are exploited through Splunk
Splunk has identified several vulnerabilities in Splunk Enterprise, particularly in versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. These vulnerabilities include: - Inadequate enforcement of authentication and authorization checks in REST APIs, allowing unauthorized users to access sensitiv...
goldig
Progetto spostato su github.com/rtfmkiesel/goldig goldig Esegue comandi su Windows tramite record DNS. Questa utility crea un server DNS e serve un record TXT malevolo. Basta copiare e incollare il comando dall'output della console nella shell Windows. Utilizzo root@kitploit: usage: goldig OPTION...
vsftpd-backdoor
Exploit per il Backdoor vsftpd 2.3.4 CVE-2011-2523 Questo exploit sfrutta un backdoor nella versione 2.3.4 del servizio FTP vsftpd. Il backdoor è stato introdotto nel codice sorgente in modo malizioso e consente l'esecuzione remota di comandi come root sul server interessato Funzionamento Il...
ysoserial
ysoserial Uno strumento proof-of-concept per generare payload che sfruttano la deserializzazione non sicura di oggetti Java. Descrizione Originariamente rilasciato come parte del talk AppSecCali 2015 "Marshalling Pickles: how deserializing objects will ruin your day" con gadget chain per Apache...
EUVD-2026-63716
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication...
EUVD-2026-63633
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper privilege management...
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Zimbra Collaboration Suite ZCS contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user...
CVE-2026-55769
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...
CVE-2026-55765
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...