CVE-2026-104355

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-104102

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configur...

CVE-2026-103061

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...

SillyRAT

SillyRAT A Cross Platform multifunctional Windows/Linux/Mac RAT. Getting Started Description A cross platform RAT written in pure Python. The RAT accept commands alongside arguments to either perform as the server who accepts connections or to perform as the client/target who establish connection...

CVE-2022-44311

Out-Of-Bounds Read in html2xhtml : CVE-2022-44311 Summary Html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elmclosetreenodet nodo at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service DoS via a crafte...

writeup_split

Abstract CVE-2024-0684 A vulnerability in the GNU coreutils "split" program allows for a heap buffer overflow with user controlled data. It was introduced in 40bf1591bb4362fa91e501bcec7c2029c5f65a43 on 2023-03-04. A fix has been released with c4c5ed8f4e9cd55a12966d4f520e3a13101637d9 on 2024-01-17...

CVE-2025-4138-4517-POC

CVE-2025-4138 / CVE-2025-4517 Python tarfile Filter Bypass via PATHMAX Symlink Escape Arbitrary file write throughfilter="data" / filter="tar" extraction Table of Contents Overview Vulnerability Details How It Works Affected Versio...

Fern Pattern Scanner

Fern Pattern Scanner Welcome to Fern's Pattern Scanner. This scanner scans through your suggested files and finds any patterns stated within the rules/rules.yaml using regex. Then a report is generated with all the findings. This project is used to showcase how a custom security scanner can be...

http2smugl

http2smugl This tool helps to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 - HTTP/1.1 conversion by the frontend server. The scheme is as follows: 1. An attacker sends a crafted HTTP/2 request to the target server, which we call frontend. 2. The request is...

CVE-2026-39973-PoC

CVE-2026-39973-PoC This is a small C apk file builder for CVE-2026-39973. Credits OnlyToxi - Helping with the path will be helping further & emotional support. iBotPeaches/Apktool - Documentation & parsing. Disclaimer This is a proof of concept , which is made for educational purposes only! AI...

CVE-2022-21350

Why two POCs? One with com.51pwn.hktalent.CreatJar.mainargs; is used to create the minimal payload generation tool. After creation, use the other one. Running CVE-2022-21350powerBy51pwn.jar to build the payload, errors do not affect the use of the payload. other exp CVE20202551 CVE20202555...

Spring0DayCoreExploit

Spring Core RCE - CVE-2022-22963 Following Spring Cloud, on March 29, another heavyweight vulnerability of Spring broke out on the Internet: Spring Core RCE The Circulating coding poc: The exploit has been uploaded asexp.py The official Spring patch is also in active production Patch Links in...

CVE-2026-108361

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

EUVD-2026-97782

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

CVE-2026-108361

The Privasys Remote Attestation TLS Clients (specifically Privasys/ra-tls-clients ) is vulnerable to a Time-of-Check Time-of-Use (TOCTOU) race condition in versions before 0.9.1 . An attacker with local access can modify workload code, data, and configuration at runtime after a successful connect...

CVE-2026-108361 Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

CVE-2026-108361 Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

CVE-2026-108362

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence...

EUVD-2026-97781

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence...

CVE-2026-108362

Privasys Remote Attestation TLS Clients versions prior to 0.11.0 are vulnerable to a diversion attack due to an Origin Validation Error (CWE-346). The software fails to require an explicitly authorized platform identity, meaning it accepts TEE attestation evidence from any unrevoked platform. A n...