CVE-2025-52691

CVE-2025-52691 SmarterMail 未授权任意文件上传远程代码执行 概述 严重未授权任意文件上传，允许远程代码执行。 字段| 值 ---|--- 产品| SmarterMail 受影响版本| Build 9406 及更早 CVSS| 10.0（严重） 类型| 任意文件上传 攻击向量| HTTP（未授权） 影响| 远程代码执行 攻击流程 root@kitploit: flowchart LR AAttacker -- B"Find Upload Endpoint" B -- C"/api/upload" C -- D"Upload ASPX Shell" D --...

CVE-2023-40924

BUGAuthor: YE Versión afectada: Contec SolarView Compact 6.00 Vendor: https://www.contecinc.com/ Archivo de vulnerabilidad: downloader.php Descripción: El atacante explota la vulnerabilidad a través de downloader.php? El parámetro file lee archivos sensibles mediante el paso de directorio...

TFTPlunder

TFTPlunder: un exploit para CVE-2023-29930 Este es un script de exploit para una vulnerabilidad de lectura/escritura ciega de archivos en el servidor de aprovisionamiento TFTP de Genesys anteriormente InIn. Información sobre la vulnerabilidad Esta vulnerabilidad se debe a opciones de configuració...

CVE-2024-52302

CVE-2024-52302：常见用户管理中的无限制文件上传漏洞 概述 我在 common-user-management 中发现了一个关键的安全漏洞，这是一个稳健的 Spring Boot 应用程序，提供用于动态控制用户访问的用户管理服务。该漏洞影响 /api/v1/customer/profile-picture 端点，允许攻击者上传未经适当验证的文件，这可能导致远程代码执行（RCE） 。 漏洞利用代码 你可以使用以下 Python 脚本来利用此漏洞： root@kitploit: python exploit.py -u "customeruser" -p "yourpasswor...

EUVD-2026-84956

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to read arbitrary files due to improper path canonicalization...

CVE-2026-96273 Ghidra before 12.1.4 Denial of Service via Crafted Database

Ghidra before 12.1.4 fails to validate the TYPECOL byte in OptionsDB.createUnregisteredOption, causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and...

MAL-2026-16427 Malicious code in @wizloft/harness-file-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d9b1885f1c19ec77095cbcbc0d9b62c99c58325bcf43c71a6438c83528bc396 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2026-85401

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

Debian dsa-6443 : docker-cli - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6443 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6443-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-63278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server o...

RockyLinux 10 : podman (RLSA-2026:70201)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/...

AlmaLinux 8 : tar (ALSA-2026:70390)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:70390 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X'...

CVE-2026-67224: Improper Limitation of a Pathname to a Restricted Directory

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...

tar security, bug fix, and enhancement update

2:1.30-13 - Backport upstream fix for CVE-2026-5704 file injection hidden from -t - Fix --one-top-level with absolute path broken by the CVE-2025-45582 fix Also fixes CVE-2026-18508 escape from --one-top-level via hardlinks. - Upstream fix for build with libacl 2.4.0 - Backport upstream patches f...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenSSH vulnerabilities (USN-8804-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8804-1 advisory. Florian Kohnhuser discovered that OpenSSH incorrectly handled shell metacharacters in certain usernames. An attacker...

CVE-2026-96546: Out-of-bounds Read

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately...

CVE-2026-96275: Improper Limitation of a Pathname to a Restricted Directory

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-92164: External Control of File Name or Path

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

Linux Distros Unpatched Vulnerability : CVE-2026-87902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If...

Linux Distros Unpatched Vulnerability : CVE-2026-55567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent...