277983 matches found
Exploit for Code Injection in Langflow
PO...
Exploit for Double Free in Linux Linux_Kernel
XSA-487 / CVE-2026-31787 Linux kernel double free in Xen pr...
Next.js 16.4.0-canary.13 Server-Side Request Forgery
Next.js version 16.4.0-canary.13 contains a DNS rebinding TOCTOU server-side request forgery vulnerability in the Image Optimizer's fetchExternalImage functionality. Next.js 16.4.0-canary.13 contains a DNS rebinding TOCTOU Server-Side Request Forgery vulnerability in the Image Optimizer's...
Flextype CMS 1.0.0-alpha.3 Remote Code Execution
Flextype CMS version 1.0.0-alpha.3 contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes. The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content...
Flextype CMS 1.0.0-alpha.3 Path Traversal
Flextype CMS version 1.0.0-alpha.3 contains a path traversal vulnerability in the Entries copy functionality. An authenticated remote attacker can supply directory traversal sequences within both the source id and destination newid parameters submitted to /api/v1/entries/copy. Description Flextyp...
...[ More ]
Payara Server contains a vulnerability in its Server-Side Includes SSI implementation that allows arbitrary operating system command execution via the exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec without validation, sanitization, or...
...[ More ]
Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in the synchronous MQTT client libpaho-mqtt3c when handling incoming PUBLISH messages with retry semantics. When a user-supplied messageArrived callback frees the received message and returns 0 indicating processing failure a...
lighttpd 2.0.0 Out-Of-Bounds Access
A signedness vulnerability exists in the lichunkqueueappendmem function in lighttpd2, where a signed length parameter gssize len is not properly validated before being used in memory operations that expect an unsigned size. When a negative length value is supplied, it is implicitly converted to a...
...[ More ]
Arbitrary code execution is possible in the MQTTVersion utility of Paho version 1.3.15 due to unsafe loading and execution of untrusted shared libraries. When a user supplies a shared library path as a command-line argument, the application loads the library using dlopen and resolves an exported...
...[ More ]
A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with thttpd. The vulnerability occurs due to unsafe copying of a user-supplied command-line argument into a fixed-size stack buffer without proper bounds checking.Specifically, the program copies the username...
...[ More ]
A stack-based buffer overflow vulnerability exists in the redirect CGI program distributed with thttpd. The vulnerability is caused by unsafe string concatenation when constructing redirect URLs using attacker-controlled CGI environment variables. A remote, unauthenticated attacker can trigger th...
jdbhttpd 0.1.0 Path Traversal / File Disclosure
jdbhttpd version 0.1.0 suffers from path traversal and file disclosure vulnerabilities. CVE-2026-56718 Unauthenticated path traversal in jdbhttpd/0.1.0 AJCloud AJY IPC firmware allowing remote reading of arbitrary files as root, including cleartext RTSP credentials. - CWE: CWE-22 Improper...
Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation
Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. These endpoints allow remote clients to perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB...
Lutece Core 7.1.7 Remote Code Execution
Lutece Core versions 7.1.7 and below suffer from an authenticated remote code execution vulnerability via XSLT injection. CVE-2026-4813 CVSS-B 9.4 CRITICAL Authenticated RCE via XSLT injection in Lutece Core Explanations and more on my website xsl:variable na...
Paho 1.3.15 Path Hijacking / Code Execution
Arbitrary code execution is possible in the MQTTVersion utility of Paho version 1.3.15 due to uncontrolled loading of shared libraries using non-absolute paths. The application invokes dlopen with relative library names and relies on the dynamic loader’s search path to resolve the target library...
...[ More ]
Flextype CMS version 1.0.0-alpha.3 contains a stored server-side request forgery SSRF vulnerability in its shortcode-processing functionality. Attacker-controlled entry fields can be automatically processed by Flextype's shortcode parser. The built-in fetch shortcode accepts an attacker-controlle...
Flextype CMS 1.0.0-alpha.3 Arbitrary File Read
Flextype CMS version 1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored shortcode processing functionality. Attacker-controlled entry fields are automatically processed by the shortcode parser when global shortcode processing is enabled. Description Flextype CMS...
Flextype CMS 1.0.0-alpha.3 Expression Injection
Flextype CMS version 1.0.0-alpha.3 contains a stored arbitrary expression injection vulnerability in the Entries ExpressionsDirective. An authenticated remote attacker with sufficient privileges to create or modify entries can persist arbitrary expression syntax within an entry field. Description...
OpenCode Unauthenticated Remote Code Execution
OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability that can allow a remote attacker to obtain a session identifier and execute arbitrary commands through the session shell endpoint. This proof of concept retrieves an available session and demonstrate...
O-CMS 1.0.0 Command Injection
O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in the AI CLI configuration functionality. An authenticated attacker with sufficient privileges can supply shell metacharacters and additional commands through the aicliscript parameter of /admin/settings/save...