CVE-2026-100105

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications incorrect authorizati...

CVE-2026-49097

camel-irc irc.sendTo Header Injection Reproducer CVE-2026-49097 This project demonstrates a message-header injection in Apache Camel's camel-irc component, tracked as CVE-2026-49097. IrcProducer reads the irc.sendTo header to choose the destination of the outgoing IRC message; when present it...

CVE-2016-4971

CVE-2016-4971 On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename. See the post on my blog for some detail. Usage On your server, node wget.js On your test computer, wget http://url.to.your/server...

cve-2026-16219-croogo-lab

CVE-2026-16219: Croogo FileManager defensive lab This repository documents and safely demonstrates the path-authorization flaw tracked as CVE-2026-16219 in Croogo CMS. It is intended for defenders, maintainers, students, and researchers testing systems they own or are explicitly authorized to...

CVE-2024-36971

CVE-2024-36971 — Proof of Concept Research & Analysis Only ⚠️ DISCLAIMER — READ BEFORE USING THIS REPOSITORY This repository is intended only for defensive research, analysis, and responsible reporting. It contains a non-exploitable proof of concept file named CVE-2024-36971 and a publicly...

CVE-2026-99122

The Linux kernel contains a vulnerability in the vsock/vmci component where vmci_transport_recv_stream_cb() fails to properly validate the source of packets for connected sockets. Specifically, the fallback mechanism for destination-only lookups in the bound table can select a non-listening socke...

CVE-2020-15778

CVE-2020-15778 Introduction This repo reproduces CVE-2020-15778. Steps 1. Build the docker images for scp server and client cd client docker build -t client-cve . cd server docker build -t server-cve . 2. Spin up the scp server in container. docker run -d -P --name scp-server server-cve Retrieve...

PT-2026-128115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci transport recv stream cb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

CVE-2020-15778-SCP-Command-Injection-Check

CVE-2020-15778 – OpenSSH SCP Command Injection Vulnerability Detection Script About CVE-2020-15778 is a command injection vulnerability discovered in the scp utility provided by OpenSSH versions ≤ 8.3p1. The issue allows an attacker to execute arbitrary commands on the client system if a crafted...

MGASA-2026-0552 Updated libde265 packages fixes a security vulnerability

Zero-length NAL passed to de265pushNAL makes memcpy run with a NULL destination. CVE-2026-88373...

Updated libde265 packages fixes a security vulnerability

Zero-length NAL passed to de265pushNAL makes memcpy run with a NULL destination. CVE-2026-88373...

PT-2026-123118

Incorrect Authorization vulnerability in ash-project ash postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many to many relationship, or a through relationship, is loaded with a lateral join for example with a per-record...

PT-2026-123117

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has one through...

CVE-2024-38063

CVE-2024-38063 PoC | DKob & N3TCR4SH Overview This script is a Proof of Concept PoC for exploiting CVE-2024-38063. It generates and sends malicious fragmented IPv6 packets with specific destination options to target a kernel, potentially causing denial-of-service or instability. Article Link: Her...

Exploit for CVE-2026-17106

copyescape-check Docker copy destination escape By Com...

CVE-2026-114583

The tarfile.tar_filter in the Python tarfile module can be bypassed using crafted link entries, such as symlinks with empty or directory-like names. This vulnerability allows a malicious tar archive to cause tarfile.extractall() (when using filter="tar") to write files outside the intended destin...

CVE-2026-114583 tar filter allows writing outside destination via empty-named symlink

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...

CVE-2026-114583 tar filter allows writing outside destination via empty-named symlink

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...

arpy

Arpy Arpy is an easy-to-use ARP spoofing MiTM tool for Mac. It provides 3 targeted functions: Packet Sniffing Visited Domains Visited Domains with Gource Each function will be explained below. Tested OS to date Darwin 14.3.0 Darwin Kernel Version 14.3.0 Mac OS X Requirements Python 2.7 Gource Sca...

CLSA-2026-1792142544 buildah: Fix of 2 CVEs

CVE-2025-11395: storage/pkg/archive, oci/archive: confine the extraction of a crafted tar archive and the reading of an extracted oci-archive to the destination...