CVE-2026-103398

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

PT-2026-67806

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description The CSVAgent component interpolates a segment of the csvFile data URI directly into a Python source-code template executed by Pyodide. Because Pyodide is loaded with a default JavaScript bridge to...

CVE-2026-32711: Improper Limitation of a Pathname to a Restricted Directory

pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID when it is set to a path outside the File-set root. pydicom resolves the path only to confirm that it exists, b...

EUVD-2019-18424

Malware in sbrugna...

EUVD-2019-18413

Malware in sbrugna...

EUVD-2021-23553

Malware in sbrugna...

EUVD-2019-18419

Malware in sbrugna...

EUVD-2020-11401

Malware in sbrugna...

EUVD-2019-18417

Malware in sbrugna...

EUVD-2020-23956

Malware in sbrugna...

EUVD-2019-18414

Malware in sbrugna...

EUVD-2019-18423

Malware in sbrugna...

EUVD-2019-18418

Malware in sbrugna...

EUVD-2019-18416

Malware in sbrugna...

EUVD-2019-18421

Malware in sbrugna...

EUVD-2008-3521

Malware in sbrugna...

EUVD-2019-18425

Malware in sbrugna...

Writing a BugSleep C2 server and detecting its traffic with Snort

In June 2024, security researchers published their analysis of a novel implant dubbed "MuddyRot"aka "BugSleep". This remote access tool RAT gives operators reverse shell and file input/output I/O capabilities on a victim's endpoint using a bespoke command and control C2 protocol. This blog will...

GHSA-66FW-43H8-F8P3 XMP Toolkit's `XmpFile::close` can trigger undefined behavior

Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occurred, it would trigger undefined behavior, typically a process abort. This is best demonstrated in issue 230, where a race condition causes the close call to fail due ...

XMP Toolkit's `XmpFile::close` can trigger undefined behavior

Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occurred, it would trigger undefined behavior, typically a process abort. This is best demonstrated in issue 230, where a race condition causes the close call to fail due ...