428228 matches found
MAL-2026-16427 Malicious code in @wizloft/harness-file-providers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d9b1885f1c19ec77095cbcbc0d9b62c99c58325bcf43c71a6438c83528bc396 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
tar security, bug fix, and enhancement update
2:1.30-13 - Backport upstream fix for CVE-2026-5704 file injection hidden from -t - Fix --one-top-level with absolute path broken by the CVE-2025-45582 fix Also fixes CVE-2026-18508 escape from --one-top-level via hardlinks. - Upstream fix for build with libacl 2.4.0 - Backport upstream patches f...
CVE-2026-67224: Improper Limitation of a Pathname to a Restricted Directory
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...
Linux Distros Unpatched Vulnerability : CVE-2026-63278
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server o...
EUVD-2026-85401
CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...
AlmaLinux 8 : tar (ALSA-2026:70390)
The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:70390 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X'...
CVE-2026-79306: Undefined Security Weakness
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...
CVE-2026-96546: Out-of-bounds Read
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately...
TencentOS Server 4: hplip (TSSA-2026:1049)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1049 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
Linux Distros Unpatched Vulnerability : CVE-2026-87902
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If...
Linux Distros Unpatched Vulnerability : CVE-2026-55567
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent...
RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Critical) (RHSA-2026:71115)
The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71115 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...
CVE-2026-79306
CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...
CVE-2026-79306
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...
CVE-2026-66068: Insertion of Sensitive Information into Log File
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...
CVE-2025-57231
CVE-2025-57231 - Docmost 0.22.0 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2025-57231. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permission to tes...
KeePass-CVE-2023-24055
KeePass-CVE-2023-24055 KeePass CVE-2023-24055 Reproduction KeePass CVE-2023-24055 Reproduction 1. Prepare machines: Kali 192.168.232.129, Windows 10 192.168.232.128 2. Keepass version: 2.53 2. Principle: By modifying the KeePass configuration file KeePass.config.xml, add a trigger configuration...
CVE-2023-45878
CVE-2023-45878 GibbonEdu Gibbon Exploit version 25.0.1 GibbonEdu Gibbon version 25.0.1 and before GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write Read More https://nvd.nist.gov/vuln/detail/CVE-2023-45878 https://herolab.usd.de/security-advisories/usd-2023-0025/ Disclaimer...
cve-lfi-lab
🧠 CVE Lab: Tier 1 SOC Analyst Simulation CVE-2025-39507 | Local File Inclusion in WordPress Nasa Core Plugin 📝 Scenario: A Day in the SOC It’s a regular Monday. I’m logged into the SOC dashboard, reviewing alerts like usual. One comes in that catches my eye: ALERT: Possible Local File Inclusion L...