CVE-2026-109574 Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

CVE-2026-109574

Hugo versions prior to v0.167.0 are vulnerable to a path traversal vulnerability within the css.Sass component. The root cause lies in the Sass compiler's import fallback mechanism, which allows malicious themes or modules to access files outside the project root. Attackers can leverage styleshee...

CVE-2026-109574 Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

CVE-2025-32463

CVE-2025-32463 - No gcc required Privilege escalation to root via sudo, with NO NEED for gcc to be installed on the target. Discovered by Rich Mirch. I have written an article explaining the attack mitigation here: Ubuntu Unattended-Upgrades Affected Versions Vulnerable: sudo 1.9.14, 1.9.15,...

kernel: bpf: Support for hardening against JIT spraying

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF Just-In-Time JIT compiler. The BPF JIT allocator reuses memory space, and when new code is written, an indirect jump into the new program can reuse a branch prediction left behind by an old program. This could allow an attacker to...

CVE-2026-103061

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...

EEF-CVE-2026-103061 Path traversal in Gleam via unvalidated package application names

Summary Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an ap...

CVE-2026-103061

The gleam-lang gleam compiler is vulnerable to a Path Traversal (CWE-22) issue in versions 0.32.4 through 1.19.2 . The root cause is the lack of validation on the app field within Hex package metadata, which the compiler uses to determine build directory names. A malicious publisher can provide a...

CVE-2026-103061 Path traversal in Gleam via unvalidated package application names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...

EUVD-2026-97758

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...

CVE-2026-103061 Path traversal in Gleam via unvalidated package application names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...

CVE-2026-15718-who-put-ptrs-in-my-wasm

CVE-2026-15718 — who put ptrs in my wasm Proof-of-concept exploit chain for CVE-2026-15718 , a missing-sync miscompilation in Mozilla SpiderMonkey's WebAssembly baseline compiler "JavaScript: WebAssembly" component. A single zero-trip array.fill yields a fakeobj primitive; the chain escalates to...

CVE-2026-14431

CVE-2026-14431 Bug fix https://chromium-review.googlesource.com/c/v8/v8/+/7950517 maglev Check map of inlined array in ArrayIteratorPrototypeNext Fixed: 523884658 Change-Id: I2a2bba817952d7023eb4b97ad41d8bb460fb9359 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7950517...

venom

VENOM 1.0.17 - generador/compilador de shellcode de metasploit Versión de lanzamiento : v1.0.17 Autor : pedro ubuntu r00t-3xp10it Nombre clave: Aconite Aconitum napellus Distros compatibles : Linux Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam desarrollo @2019 DESCARGO DE...

PT-2026-111013

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

CVE-2026-109574: Improper Limitation of a Pathname to a Restricted Directory

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

Rocky Linux 9.2 [CIQ] Security Update: protobuf / protobuf-compiler / protobuf-devel / protobuf-lite / etc (ciqsa-2026_1628)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261628 advisory. This advisory aggregates security fixes for the protobuf SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2021-22570. Tenable has extracted the preceding description...

CVE-2021-44228

CVE-2021-44228-POC Yet another CVE-2021-44228 POC Affected Log4j versions: from 2.0-beta9 up to 2.14.1 Prerequisites Used Java: OpenJDK 11 https://jdk.java.net/archive/ Maven required to build apps in this repo alternatively, download prepared jar files from release: https://maven.apache.org/...

pharos

Pharos Framework de Análisis Estático de Binarios El framework de análisis estático de binarios Pharos es un proyecto del Software Engineering Institute de la Carnegie Mellon University. El framework está diseñado para facilitar el análisis automatizado de programas binarios. Utiliza la...

CVE-2025-50360

Heap Buffer Overflow in Pepper Language Pepper Language is a fast interpreted programming language for simplicity and verbosity. It is dynamically typed and supports garbage collection. Affected Version: Version 0.1.1 and before, Commit 961a5d9988c5986d563310275adad3fd181b2bb7 and before. Status:...