CVE-2026-59172

Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, joker --lint walks upward from the linted file to locate a .jokerd/ directory and executes matching linter. files before linting. Those files contain executable Joker/Clojure code, so linting a file inside a...

CVE-2026-59177

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...

INE-Host-and-Network-Penetration-Testing-Exploitation-CTFf-1

Host & Network Penetration Testing: Exploitation CTF 1 Ove...

CVE-2026-105420

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner...

CVE-2015-8522.RCE

CVE-2015-8522 The Tivoli FastBack Server 6.1.4 application is vulnerable to a stack-based buffer overflow allowing threat-actors to gain Arbitrary Code Execution ACE via a remote TCP-connection. The PoC provided in this repository leverages this vulnerability to both execute CMD.exe on the target...

CVE-2026-105420 Path Traversal in Wing WFTP Server leading to Remote Code Execution

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner...

CVE-2026-105420

The Wing FTP Server is vulnerable to a path traversal issue (CWE-22) because it fails to verify the user's base folder. An attacker with admin privileges can use scripts to add user directories that escape the base folder. This allows the attacker to write files to the system, potentially leading...

EUVD-2026-112084

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner...

CVE-2026-93515

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

CVE-2026-93516

A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context...

CVE-2026-67074

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise...

CVE-2026-93517 X.Org Server GLX RenderLarge Heap Buffer Overflow

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context...

EUVD-2026-112082

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context...

CVE-2026-93517

A heap-based buffer overflow exists in the xorg-x11-server (specifically the GLX interface) due to a failure to verify that incoming data sizes do not exceed allocated buffer limits during GLX RenderLarge requests. This vulnerability affects X.org X server versions prior to 21.1.25 and XWayland v...

CVE-2026-93517 X.Org Server GLX RenderLarge Heap Buffer Overflow

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context...

CVE-2026-93517

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context...

CVE-2026-59177

The ESPHome Device Builder Dashboard (versions prior to 1.0.10 ) is vulnerable to unauthenticated access when running as a Home Assistant add-on using host networking. The issue arises because the trusted ingress site binds to 0.0.0.0, allowing any device on the local network to bypass the superv...

CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...

CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...

brotli: Out-of-Bounds Write in Google Brotli Decoder

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...