19847 matches found
GHSA-QQW8-7C2R-JXCH Sigstore Java has a vulnerability with bundle verification of integratedTime
Summary Regression: Verification of integratedTime from Rekor V1 Log Entry against Fuclio Certificate validity was missing Details - PR 1008 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. - PR 1185 re-added this verification with enhancements...
cossacks-back-to-war-exploit
⚠️ Disclaimer The code in this repository is provided as-i...
Exploit for CVE-2026-31694
FUSE readdir cache out-of-bounds write PoC Local proof of con...
exploitarium
If you wish to collaborate/discuss with me, contact me on discor...
0-day-PoC-Repo
If you wish to collaborate/discuss with me, contact me on discor...
Exploit for CVE-2026-43503
CVE-2026-43503 DirtyClone - PoC - SecurewithUmer POC of Dir...
Exploit for Uncontrolled Resource Consumption in Github Cmark-Gfm
graylog-cve-2023-24824-exploit Proof-of-...
Exploit for Improper Access Control in Graylog
Exploiting Arbitrary Class Loading on the JVM This repository...
exploitarium-fork
If you wish to collaborate/discuss with me, contact me on discor...
Langflow Knowledge Bases API is Vulnerable to Path Traversal
SummaryLangflow is vulnerable to Path Traversal in the Knowledge Bases API DELETE /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are concatenated directly into file paths without proper sanitization or boundary validation. An authenticated attacker can exploit this...
PYSEC-2026-477 PraisonAI has critical RCE via `type: job` workflow YAML
praisonai workflow run loads untrusted YAML and if type: job executes steps through JobWorkflowExecutor in jobworkflow.py. This supports: - run: → shell command execution via subprocess.run - script: → inline Python execution via exec - python: → arbitrary Python script execution A malicious YAML...
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
exploitarium
If you wish to collaborate/discuss with me, contact me on discor...
Malicious code in yandex-geobase (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f6219d513896736aee31ce33719d6ae2d1f5b03293ecdfe884d944bbb3eb99a [email protected] squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTTP GET to a hardcoded bare-...
openstamanager-cve-poc
This might be an opportunity for bo...
PT-2026-53551
The Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker or compromised agent to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments ../ in the target path, malicious actions can overwrite sensitive...
astra-poc
Astra POC Framework A general-purpose POC Proof of Concept...
MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...