FreeScout < 1.8.225 - Unauthenticated Maintenance File Existence Oracle

FreeScout before 1.8.225 exposes the maintenance endpoint /tools.php without authentication; different responses to existing and non-existing PHP paths disclose filesystem path existence before credential validation. id: CVE-2026-62850 info: name: FreeScout 1.8.225 - Unauthenticated Maintenance...

exploit-CVE-2016-8016-25

McAfee Virus Scan for Linux multiple remote flaws THIS EXPLOIT AND ALL THE CODE IN THIS REPO WERE REMOVED TO AVOID ANY PROBLEMS REGARDING VIOLATING ANY MCAFEE LICENSE McAfee VirusScan Enterprise for Linux is a enterprise antivirus solution by Mcafee. Its unique, Linux-based on- access scanner...

CVE-2022-47952

Suggested description lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace...

CVE-2024-39719

Ollama File Existence Disclosure Vulnerability CVE-2024-39719 Analysis 中文 Vulnerability Overview CVE-2024-39719 is a file existence disclosure vulnerability affecting Ollama versions 0.3.14 and earlier. This vulnerability allows attackers to detect the existence of specific files on the server...

CVE-2026-76806 Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle

Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because...

CVE-2026-76806

The open-source time-tracking application Solidtime (prior to version 0.16.0 ) is vulnerable to a Path Traversal flaw in its TogglDataImporter::importData() function. The vulnerability exists because the importer reads attacker-controlled project ID values from projects.json within uploaded ZIP f...

Linux Distros Unpatched Vulnerability : CVE-2026-54659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and...

SUSE CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the realpathSync function in the fs module. An attacker can probe whether paths outside the permitted fs.read set exist by supplying them to fs.realpathSync, whose lstat walk reveals whether a path is missing...

EUVD-2026-107152

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

Amazon Linux 2023: CVE-2026-50106: Medium priority package update for unbound

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

PT-2026-120507

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2 Description An issue exists when the software is configured with both a root trust anchor and an additional trust-anchor: for an island-of-security zone whose parent is provably insecure under the ro...

PT-2026-134538

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

Linux Distros Unpatched Vulnerability : CVE-2026-88834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build...

CLSA-2026-1792540155 bind: Fix of 2 CVEs

CVE-2026-13321: Reject NSEC records whose next owner name points outside the signer's zone, which let a signed zone forge proofs of non-existence for other zones - CVE-2026-11622: Reference count the cache rdataset headers so a superseded generation is freed as soon as nothing holds it, instead...

npm: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

npm: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...

npm: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

npm: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

npm: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

npm: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress npm launch-editor versions = 2.14.1...

npm: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

npm: ApostropheCMS: :id/locales REST route omits the public-API authorization gate its sibling read routes enforce unauthenticated doc-existence + locale metadata disclosure vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

CVE-2026-113668 ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this...