AnythingLLM - Username Enumeration via Password Recovery

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling...

Vitest Browser Mode - Local File Read

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host- true, an attacker can send a request to that handler from remote to get th...

gha-lab-733c168b88

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of MIC-DKFZ/nnUNet at commit...

Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

CVE-2026-46242

CVE-2026-46242 full poc and lpe Kernel Range Status Notes 5.15.209 - 5.16 Affected Backported introducing commit 6.1.175 - 6.2 Affected Backported introducing commit 6.4 - 6.18.32 Affected Bug introduced in mainline 6.4 6.19 - 7.0.9 Affected Includes latest stable v6.1-based Pixel 8, older NOT...

scanner-cli

Deprecation Notice: Hawkeye has reached its end of life. There are more modern options out there for you and your project. If you wish to pick up maintenance of the project, please feel free to contact me. You'll find means of reaching out to me on my personal homepage. . . . . . . The Hawkeye...

cve-2025-62726-poc

CVE-2025-62726 POC - n8n Git Node RCE Educational Purpose This is a proof-of-concept demonstration for CVE-2025-62726, created for educational purposes as part of a class project. Part of CMU Course : 18-739 Hacking & Offensive Security in Fall 2025 Vulnerability Overview CVE ID: CVE-2025-62726...

CVE-2010-2387

CVE-2010-2387 Version: https://github.com/GNOME/gdm/tree/2799f52e01354944c0f464aa93bc5adfbc6bc0e8...

cve-2022-30190

cve-2022-30190 Aka Follina = benign POC. Notes: Commit 5ea77 doesn't work...

UBUNTU-CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

SUSE CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

CVE-2026-98684

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOCFLKEEPSIZE fallocate emulation for small interior ranges in smb3simplefallocaterange issues FSCTLQUERYALLOCATEDRANGES and zero-fills any...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: A null check was added for toppipetoprogram in the commitplanesforstream function. This fix addresses a null pointer dereferencing issue in the commitplanesforstream function at line 4140. The issue could occur...

Astra Linux – Vulnerability in Freetype

It was discovered that the FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f contains a heap buffer overflow issue through the sfntinitface function...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed error handling in ext4fcrecordmodified inode. The current code does not properly handle the krealloc error case, which could lead to silent memory corruption or a kernel bug. This patch addresses this issue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ext4: Fix for accessing an uninitialized lock in the fc replay path. The following kernel trace can be triggered with fstest generic/629 when executed against a filesystem with the fast-commit feature enabled: INFO: Trying to...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm thin: Use the pmd-root from the last transaction when commit fails. Recently, we discovered a problem with a softlockup in the dm thin pool’s btree lookup code due to corrupted metadata. Kernel panic – not syncing: Softlockup:...

Astra Linux – Vulnerability in Graphviz

A buffer overflow in the Graphviz Graph Visualization Tools, starting from the commit ID f8b9e035 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service application crash by loading a crafted file into the "lib/common/shapes.c" component...

CVE-2026-102037 Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used

An XML Injection vulnerability in the Unified Threat Management daemon utmd of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server...