17737 matches found
📄 Python-Multipart 0.0.22 Path Traversal
Python-Multipart version 0.0.22 suffers from a path traversal vulnerability. Exploit Title: Python-Multipart 0.0.22 - Path Traversal Date: 2026-02-23 Exploit Author: cardosource Vendor Homepage: https://github.com/Kludex/python-multipart Software Link: https://pypi.org/project/python-multipart/...
PT-2026-38894
Summary attachments: pocs.zip Submodule names coming from .gitmodules are exposed as unvalidated names and are later reused to derive the submodule git directory as: /modules/ Because the submodule name is joined directly as a filesystem path component, a name such as ../../../escaped-target.git...
CVE-2026-44721
creationtimestamp| type| source ---|---|--- 2026-05-04 23:42:51+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-gf5m-wcrh-7928...
Arbitrary File Upload
Overview devcode-it/openstamanager is a management software for technical assistance and electronic invoicing Affected versions of this package are vulnerable to Arbitrary File Upload via the uploadmodules.php process. An attacker can upload arbitrary files by exploiting insufficient validation...
GHSA-6PJF-3R9X-M592 Distribution's tag deletion bypasses `storage.delete.enabled` configuration
Summary Tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. Details When storage.delete.enabled is configured to false,...
OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
Impact The ConceptReferenceRangeUtility.evaluateCriteria method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default...
GHSA-XJ4F-8JJG-VX4Q OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
Impact The ConceptReferenceRangeUtility.evaluateCriteria method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default...
CVE-2026-44310
creationtimestamp| type| source ---|---|--- 2026-05-04 16:54:58+00:00| published-proof-of-concept| https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5...
CVE-2026-44429
creationtimestamp| type| source ---|---|--- 2026-05-04 14:34:31+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4...
CVE-2026-44427
creationtimestamp| type| source ---|---|--- 2026-05-04 12:25:03+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-v8vw-gw5j-w7m6...
CVE-2026-44670
creationtimestamp| type| source ---|---|--- 2026-05-04 07:03:18+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h64-c999-c9r6...
Exploit for CVE-2026-27778
PoC-SimulatorCVE-2026-27778...
CVE-2026-44009
creationtimestamp| type| source ---|---|--- 2026-05-03 21:34:48+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm 2026-07-09 07:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq753cw5on2d...
CVE-2026-44008
creationtimestamp| type| source ---|---|--- 2026-05-03 21:34:12+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq 2026-07-09 07:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq75jncjll2q...
Exploit for Missing Authentication for Critical Function in Cpanel
CVE-2026-41940-POC cPanel/WHM Authentication Bypass Proof of...
Arbitrary Code Injection
Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Arbitrary Code Injection via the eval function in the LambdaFilterComponent component. An attacker can execute arbitrary...
Exploit for Missing Authentication for Critical Function in Cpanel
POCCVE-2026-41940 Quick start bash python3 pocCVE-202...
summary-awi-poc
summary-awi-poc Public proof-of-concept repository for valida...