📄 pfSense Ultimate Exploit Framework

This Python script is an exploitation framework targeting two authenticated remote code execution vulnerabilities in pfSense. One exploit vector is an unsafe deserialization in pfSense CE version 2.7.2 and another is related to XMLRPC execphp abuse in pfSense CE version 2.8.0...

WordPress plugin Advanced AJAX Product Filters 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

Bosch Rexroth IndraWorks 安全漏洞

Bosch Rexroth IndraWorks is a general engineering framework software developed by the German company Bosch Rexroth. Bosch Rexroth IndraWorks has a security vulnerability that stems from deserialization issues when parsing specially crafted files containing malicious serialized data, which may lea...

PT-2026-20414

A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which...

Bosch Rexroth IndraWorks 安全漏洞

Bosch Rexroth IndraWorks is a general engineering framework software developed by the German company Bosch Rexroth. Bosch Rexroth IndraWorks has a security vulnerability that stems from deserialization issues when parsing specially crafted files containing malicious serialized data, which may lea...

Bosch Rexroth IndraWorks 安全漏洞

Bosch Rexroth IndraWorks is a general engineering framework software developed by the German company Bosch Rexroth. Bosch Rexroth IndraWorks has a security vulnerability that stems from deserialization issues when parsing specially crafted files containing malicious serialized data, which may lea...

Incomplete Fix for CVE-2025-10279: get_or_create_nfs_tmp_dir() Still Creates World-Writable (0o777) Directories Enabling Local Code Execution

Description Description CVE-2025-10279 huntr bounty 01d3b81e identified that MLflow's getorcreatetmpdir created temporary directories with world-writable permissions 0o777, enabling local attackers to tamper with model artifacts and achieve arbitrary code execution. The fix PR 17544, commit...

OSEC-2026-01 Buffer Over-Read in OCaml Marshal Deserialization

Summary A critical buffer over-read vulnerability in OCaml's Marshal deserialization runtime/intern.c enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock function, which performs unbounded memcpy operations usin...

CVE-2026-2555

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...

CVE-2026-26220

CVE-2026-26220 affects LightLLM

CVE-2026-26220 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

CVE-2026-26220 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

PT-2026-22292

Name of the Vulnerable Software and Affected Versions OCaml versions prior to 4.14.3 and 5.x versions prior to 5.4.1 Description A flaw exists in OCaml's Marshal deserialization process within runtime/intern.c that could allow for remote code execution. This issue stems from a missing bounds chec...

Exploit for CVE-2025-69690

🔐 CVE-2025-69690 & CVE-2025-69691 Authenticated Remote Co...

EUVD-2026-6091

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...

CVE-2026-2555

CVE-2026-2555 affects JeecgBoot 3.9.1 in the Retrieval-Augmented Generation component, specifically the importDocumentFromZip function in AiragKnowledgeController.java. The issue is a deserialization vulnerability triggered by manipulating input, allowing a remote attacker to exploit the flaw. Th...

CVE-2026-2555 JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...

CVE-2026-2555 JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...

CVE-2026-2555

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...

CVE-2026-2555 JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...