CVE-2026-81560

blackms aistack versions up to 1.6.1 are affected by a path traversal vulnerability in the Static File Handler component (file src/web/server.ts). The root cause is improper handling of the req.url argument, which can be manipulated to access files outside the intended directory. The attack is re...

EUVD-2026-66998

A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The explo...

CVE-2026-81560 blackms aistack Static File server.ts path traversal

A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The explo...

CVE-2026-81572

In CodeMeter Runtime from version 8.40 to excluding 8.41a and 9.00 to excluding 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before fi...

CVE-2026-78274

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78275

Editor Arbitrary File Deletion in Fluent Boards Pro = 2.0.11 versions...

cpanel-pwn

cpanel-pwn Kit di test di sicurezza per cPanel/WHM. Implementa il bypass dell'autenticazione tramite iniezione CRLF CVE-2026-41940 e il pivot dei privilegi post-exploitation. Strumenti Script| Scopo ---|--- cpanelexploit.py| CVE-2026-41940: iniezione CRLF → bypass autenticazione WHM → accesso roo...

CVE-2026-81659

Flowintel is vulnerable to arbitrary local file read via its note PDF export feature. Attacker-controlled note content is processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export. The CVSS 4...

CVE-2026-81659 Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...

CVE-2026-81659 Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...

EUVD-2026-66995

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...

CVE-2026-26336-PoC

CVE-2026-26336 — Alfresco Share Unauthentifiziertes Dateilesen Überblick Alfresco Share stellt einen /share/page/resource/-Endpunkt bereit, der zum Ausliefern statischer Ressourcen verwendet wird. In verwundbaren Versionen schränkt dieser Endpunkt Pfad-Traversal nicht ordnungsgemäß ein, sodass ei...

CVE-2026-58073-check

Script di rilevamento dello stato di patch per l'impersonificazione dell'agente di Veeam Service Provider Console Un rilevatore sicuro e non autenticato per le vulnerabilità KB4893 in Veeam Service Provider Console pubblicato il 04-08-2026. Risponde a una domanda per ogni target, prima di qualsia...

Research-CVE-2026-21858

CVE-2026-21858 Ni8mare: Bypass dell'autenticazione ed esecuzione remota di codice in n8n 1. Panoramica della vulnerabilità Nome: Ni8mare ID CVE: CVE-2026-21858 Punteggio CVSS: 10.0 Critico Tipo di vulnerabilità: Bypass dell'autenticazione, Inclusione locale di file LFI, Esecuzione remota di codic...

CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla

CVE-2026-21627 Nicht authentifizierte beliebige Dateieinbindung im Novarain Framework von Joomla nrframework Überblick Eine kritische Schwachstelle im Tassos/Novarain Framework plgsystemnrframework Joomla-Plugin ermöglicht es nicht authentifizierten Angreifern, beliebige PHP-Dateien auf dem Serve...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Unbeschränkter Datei-Upload zu RCE Beschreibung Bludit CMS-Versionen vor 3.18.4 erlauben einem authentifizierten Angreifer mit einem gültigen API-Token, Dateien beliebigen Typs und beliebiger Erweiterung über den Endpunkt POST /api/files/ hochzuladen. Die Funktion...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Caricamento Arbitrario di File Non Autenticato. Descrizione : Il plugin Ninja Forms - File Uploads per WordPress è vulnerabile al caricamento arbitrario di file non autenticato a causa della mancanza di validazione del tipo di file e della mancan...

CVE-2026-4350

CVE-2026-4350 - Perfmatters WordPress Eliminazione Arbitraria di File Descrizione CVE-2026-4350 è una vulnerabilità di eliminazione arbitraria di file nel plugin WordPress Perfmatters. Dettagli CVE CVE: CVE-2026-4350 Gravità: ALTA CVSS: 8.1 Plugin interessato: Perfmatters Versione interessata: =...

CVE-2026-32202

PoC root@kitploit: python3 CVE-2026-32202.py -h usage: CVE-2026-32202.py -h --unc PATH --out FILE --applet-id INT --name STR --infotip STR --no-dump Generate a test LNK file with an IDCONTROLW structure. Research tool for CVE-2026-21510 / CVE-2026-32202 patch analysis. options: -h, --help show th...

CVE-2026-31431-CopyFail-Lab

CVE-2026-31431 "Copy Fail" — Laboratorio LPE del Kernel Linux Panoramica Questo repository documenta un'indagine di laboratorio completa su CVE-2026-31431 Copy Fail , una vulnerabilità di escalation dei privilegi locali LPE ad alta gravità nel modulo crittografico algifaead del kernel Linux,...