19853 matches found
CVE-2026-42581
creationtimestamp| type| source ---|---|--- 2026-05-05 18:08:44+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9...
CVE-2026-42587
creationtimestamp| type| source ---|---|--- 2026-05-05 18:07:09+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv...
CVE-2026-42578
creationtimestamp| type| source ---|---|--- 2026-05-05 18:05:31+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr...
CVE-2026-44567
creationtimestamp| type| source ---|---|--- 2026-05-05 15:47:41+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf...
CVE-2026-44566
creationtimestamp| type| source ---|---|--- 2026-05-05 15:44:20+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-9pgh-j74g-qj6m...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
CVE-2026-31431 Copy Fail Toolset This repository contains t...
Exploit for Double Free in Apache Http_Server
CVE-2026-23918-test This repository contains a Proof of Concep...
CVE-2026-44737
creationtimestamp| type| source ---|---|--- 2026-05-05 10:55:40+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-fmg2-f5r9-24qc...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
Copy Fail ARM64 Research CVE-2026-31431 Analysis and ARM64...
CVE-2026-44588
creationtimestamp| type| source ---|---|--- 2026-05-05 05:57:59+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25rp-h46x-2hjm...
CVE-2026-350234
creationtimestamp| type| source ---|---|--- 2026-05-05 03:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/82846 2026-05-05 09:00:04+00:00| seen| Telegram/YNBAQ7wY3nDaf6oW9SSpET1W5P-GdTLvm9dgaOEDkfw4Y...
PT-2026-38894
Summary attachments: pocs.zip Submodule names coming from .gitmodules are exposed as unvalidated names and are later reused to derive the submodule git directory as: /modules/ Because the submodule name is joined directly as a filesystem path component, a name such as ../../../escaped-target.git...
📄 Python-Multipart 0.0.22 Path Traversal
Python-Multipart version 0.0.22 suffers from a path traversal vulnerability. Exploit Title: Python-Multipart 0.0.22 - Path Traversal Date: 2026-02-23 Exploit Author: cardosource Vendor Homepage: https://github.com/Kludex/python-multipart Software Link: https://pypi.org/project/python-multipart/...
CVE-2026-44721
creationtimestamp| type| source ---|---|--- 2026-05-04 23:42:51+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-gf5m-wcrh-7928...
Arbitrary File Upload
Overview devcode-it/openstamanager is a management software for technical assistance and electronic invoicing Affected versions of this package are vulnerable to Arbitrary File Upload via the uploadmodules.php process. An attacker can upload arbitrary files by exploiting insufficient validation...
GHSA-6PJF-3R9X-M592 Distribution's tag deletion bypasses `storage.delete.enabled` configuration
Summary Tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. Details When storage.delete.enabled is configured to false,...
OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
Impact The ConceptReferenceRangeUtility.evaluateCriteria method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default...
GHSA-XJ4F-8JJG-VX4Q OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
Impact The ConceptReferenceRangeUtility.evaluateCriteria method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default...