wordlists

Wordlists Real-world infosec wordlists, updated regularly Current Wordlists Technologies These wordlists are based on the source code of the CMSes/servers/frameworks listed here. The current wordlists include: Wordpress Joomla Drupal Magento Ghost Tomcat There are 2 versions of each wordlist: Bas...

go_parser

Yet Another Golang binary parser for IDAPro English |中文 NOTE : Now the latest master branch is the Python3 version. The old master branch has been changed to branch py2 , and temporarily not maintained. Instructions for Python3 branch This version is developed and tested on macOS/Windows, IDA7.4+...

patch: Filename validation bypass in reversal fallback allows file creation outside the working directory

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

PT-2026-140351

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.can read permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs ar...

EUVD-2026-118613

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...

CVE-2026-101259

A flaw was found in the Apache Camel CoAP Constrained Application Protocol component. When a CoAP consumer fails to construct a response after a route completes, internal exception details are returned directly to the client in an error response payload rather than being suppressed. A remote...

CVE-2025-13647

The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header. Successful exploitation can lead to the unintended exposure of the file...

CVE-2025-13647 Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths

The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header. Successful exploitation can lead to the unintended exposure of the file...

CVE-2025-13647

Multiple WSO2 products are vulnerable to an information disclosure vulnerability due to insufficient validation of the content-type header during request processing. An attacker can submit a crafted request with a manipulated header to expose the file paths for certificate files . This disclosure...

CVE-2025-13647 Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths

The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header. Successful exploitation can lead to the unintended exposure of the file...

EUVD-2025-211234

The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header. Successful exploitation can lead to the unintended exposure of the file...

WSO2 Identity Server information disclosure vulnerability

Vulnerabilities related to information disclosure exist in WSO2 Identity Server versions prior to 5.10.0 through 5.10.0.381, 5.11.0 through 5.11.0.428, 6.0.0 through 6.0.0.255, 6.1.0 through 6.1.0.255, 7.0.0 through 7.0.0.133, 7.1.0 through 7.1.0.41, and 7.2.0 through 7.2.0.3. This vulnerability...

PT-2026-135359

The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header. Successful exploitation can lead to the unintended exposure of the file...

CVE-2025-13647: WSO2: The affected component fails to enforce expected validation constraints on the `content-type` header when processing…

The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header. Successful exploitation can lead to the unintended exposure of the file...

CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths

The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...

CLEANSTART-2024-VY78190 When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins

Security vulnerability affects the librewolf package. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins...

CLEANSTART-2024-LG98831 When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins

Security vulnerability affects the firefox package. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins...

CLEANSTART-2024-LN74064 When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins

Security vulnerability affects the firefox package. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins...

VulnCheck KEV: CVE-2025-11201

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-97860

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges...