EUVD-2026-91854

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

[SECURITY] Fedora 45 Update: dicomanonymizer-1-0.22.20210920gitf076264.fc45

A multi-threaded anonymizer for DICOM files implementing most of DICOM PS 3.15 AnnexE. Entries such as uid entries are replaced with hash values. This ensur es that partial runs of a studies DICOM files can be merged afterwards. This project is written in C++ using the gdcm library and multiple...

[SECURITY] Fedora 45 Update: dcmtk-3.6.9-9.fc45

DCMTK is a collection of libraries and applications implementing large parts the DICOM standard. It includes software for examining, constructing and converting DICOM image files, handling offline media, sending and receiving images over a network connection, as well as demonstrative image storag...

CVE-2026-104478

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

Fedora 43 : cockpit-files (2026-a643ae21d6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a643ae21d6 advisory. Automatic update for cockpit-files-45-1.fc43. Changelog for cockpit-files Wed Sep 23 2026 Packit - 45-1 - Fixes CVE-2026-91202, CVE-2026-91203,...

Fedora 44 : cockpit-files (2026-d8f5999539)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d8f5999539 advisory. Automatic update for cockpit-files-45-1.fc44. Changelog for cockpit-files Wed Sep 23 2026 Packit - 45-1 - Fixes CVE-2026-91202, CVE-2026-91203,...

PT-2026-104533

Name of the Vulnerable Software and Affected Versions Loco Translate WordPress plugin versions prior to 2.8.9 Description Insufficient restriction of file paths within translation file routes allows users with translator capabilities to retrieve the contents of specific file types from any locati...

PT-2026-104475

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.19.0 Description The software fails to block recipe files in the converters/calibre.ts component, passing them directly to the Calibre ebook-convert program. This allows the execution of arbitrary code contained...

PT-2026-104519

Name of the Vulnerable Software and Affected Versions MPG WordPress plugin versions prior to 4.2.3 Description Insufficient validation of the dataset source during project import allows users with the Editor role and above to specify a local filesystem path instead of a remote URL. This leads to ...

cupspot-2024-47177

CUPS Honeypot Overview This project implements a honeypot for capturing attempted exploitations of vulnerabilities in the CUPS Common UNIX Printing System. Specifically, it is designed to monitor for exploitation attempts related to CVE-2024-47177. This vulnerability allows remote command executi...

czds

CZDS What is CZDS? Each Top Level Domain TLD is maintained by a registry operator, who also manages a publicly available list of Second Level Domains SLDs and the details needed to resolve those domain names to Internet Protocol IP addresses. The registry operator’s zone data contains the mapping...

CVE-2026-104478 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

CVE-2026-104478 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

CVE-2026-104478

Formwork versions prior to 2.3.13 are vulnerable to a path traversal vulnerability in the BackupController component. Authenticated panel users with backup download or delete permissions can exploit this by supplying a base64-encoded backslash-separated traversal payload . This payload bypasses t...

COFFLoader

COFF Loader This is a quick and dirty COFF loader AKA Beacon Object Files. Currently can run un-modified BOF's so it can be used for testing without a CS agent running it. The only exception is that the injection related beacon compatibility functions are just empty. The main goal is to provide a...

MassScanning-CVE-2025-55182

VPS Continuous Scanner A lightweight orchestrator and worker scanner setup for running large/continuous scans across split input files. This repository contains orchestration scripts, a Docker-based worker image, and helper scripts to run scans repeatedly and collect results. Repository layout...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 Proof of concept Writeup: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ The python script abuses the upload function that is availible unauthenticated at /admin/files-upload/ The script locally creates a bin folder and a file named...

CVE-2026-51907

In TaskingAI v0.3.0 in the QR Code Generator plugin savebase64image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the projectid parameter...

CVE-2026-104471

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

CVE-2026-104442

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...