PT-2026-104618

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The...

openSUSE 16: libwireshark18 / libwiretap15 / libwsutil16 / wireshark / etc (openSUSE-SU-2026:22014-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22014-1 advisory. Update to Wireshark 4.4.18: - CVE-2026-19694: TTX Logger file parser crash bsc1275279. - CVE-2026-19695: Gammu DCT3 trace file parser crash...

openSUSE 16: libIex-3_2-31 / libIex-3_2-31-x86-64-v3 / libIlmThread-3_2-31 / etc (openSUSE-SU-2026:22013-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22013-1 advisory. This update for openexr fixes the following issue: - CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted...

CVE-2026-105144: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The...

CVE-2026-105123: Unrestricted Upload of File with Dangerous Type

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2025-34299

CVE-2025-34299 Les versions 2.11 et antérieures de Monsta FTP contiennent une vulnérabilité permettant le téléchargement arbitraire de fichiers sans authentification. Cette faille permet à un attaquant d'exécuter du code arbitraire en téléchargeant un fichier spécialement conçu depuis un serveur...

[SECURITY] [DLA 4815-1] freecad security update

Debian LTS Advisory DLA-4815-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost October 03, 2026 https://wiki.debian.org/LTS Package : freecad Version : 0.20.2+dfsg1-4+deb12u1 CVE ID : CVE-2026-34789 CVE-2026-73234 CVE-2026-73235 Debian Bug : 1144349 Three...

Ashwesker-CVE-2025-52691

🚨 CVE-2025-52691 — ثغرة أمنية حرجة في SmarterMail الحالة: 🔥 حرجة — مطلوب إجراء فوري درجة CVSS v3.1: 10.0 / 10 تاريخ الإفصاح: 29–30 ديسمبر 2025 🧩 ملخص الثغرة الأمنية CVE-2025-52691 هي ثغرة أمنية حرجة وغير موثّقة لرفع الملفات بشكل تعسفي arbitrary file upload تؤثر على SmarterTools SmarterMail Server...

disclosure-thinkware-u3000

Thinkware U3000 Dashcam : Vulnérabilités de sécurité Trois vulnérabilités dans le protocole de contrôle WiFi local de la dashcam Thinkware U3000, découvertes par rétro-ingénierie de l'application Android officielle et confirmées sur du matériel réel. Toutes les trois ne nécessitent qu'un accès au...

pipe-primitive

pipe-primitive Une primitive d'exploitation dans le noyau Linux inspirée par DirtyPipe CVE-2022-0847. Il y a quelques jours, comme beaucoup de mes aînés en sécurité, j'ai étudié et reproduit la vulnérabilité DirtyPipe CVE-2022-0847, et j'ai profondément ressenti à quel point cette faille est...

CVE-2021-27513-CVE-2021-27514

exploit-eyesofnetwork الإصدار 5.3.5 حتى 5.3.10 CVE-2021-27513 / CVE-2021-27514 يمكن أن يستغرق التخمين بالقوة وقتًا طويلاً جدًا في بيئة غير إنتاجية لأن "sessionid" يُنشأ في كل تسجيل دخول ولكن كل sessionid الذي يولده التطبيق صالح للإثبات، قمت بنشر حل EyesOfNetwork وحاكيت استخدامًا يوميًا مع 300 تسج...

Grafana-CVE-2024-9264

Grafana-CVE-2024-9264 POST /api/ds/query?dstype=expr&expression=true&requestId=Q100 HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json Cookie: grafanasession=a739fa9aeb235f2790f17de00fefe528 Content-Length: 368 "from": "1696154400000", "to": "1696345200000", "queries": "datasource":...

CVE-2023-47668

CVE-2023-47668 Restrict Content = 3.2.7 - كشف المعلومات عبر ملف السجل القديم الوصف: إضافة العضوية – إضافة Restrict Content لووردبريس معرضة لكشف المعلومات الحساسة في جميع الإصدارات حتى 3.2.7 عبر ملف السجل القديم. وهذا يتيح للمهاجمين غير الموثوقين استخراج بيانات حساسة بما في ذلك معلومات التصحيح...

Exploit for CVE-2026-103648

CVE-2026-103648 — Path Traversal in image-downloader !CV...

hosts v3.16.119

!IMPORTANT Cloning this repository can take a long time! You probably just want to start with the latest version, not its whole history since 2018. Therefore you probably want to use git clone --depth 1 ... to save significant time. !NOTE With the exception of issues and PRs regarding changes to...

CVE-2021-22204

CVE-2021-22204 - ExifTool 任意代码执行 这是针对 CVE-2021-22204 的升级版概念验证（PoC），该漏洞影响 ExifTool 7.44 至 12.23 版本，在处理恶意 DjVu 文件时可导致任意代码执行。 致谢 本文为衍生作品。该漏洞及原始利用代码并非本人所发现。 角色| 人员 ---|--- 漏洞发现者| William Bowling @wcbowling，通过 GitLab 漏洞赏金计划提交 — 2021 年 4 月 原始 PoC 作者| UNICORD NicPWNs & Dev-Yeoj 本仓库修改者| d4ytox 描述 ExifToo...