7295 matches found
CVE-2026-12894
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...
Node.JS System Information Library <5.3.1 - Remote Command Injection
Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...
CVE-2025-55182
CVE-2025-55182 — React Server Components 인증되지 않은 RCE 심각도: Critical — CVSS 10.0 CWE: CWE-502 신뢰할 수 없는 데이터 역직렬화 공급업체: Meta Facebook 공개일: 2025년 12월 3일 개요 CVE-2025-55182는 React Server ComponentsRSC에서 발견된 최대 심각도의 인증되지 않은 원격 코드 실행RCE 취약점으로, React2Shell 이라고 명명되었습니다. 이 결함은 React가 Flight 프로토콜 을 통해 React...
CVE-2026-82654 SiYuan before v3.8.1 Stored XSS via block name
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...
DVFaaS-Damn-Vulnerable-Functions-as-a-Service
DVFaaS - 매우 취약한 함수 서비스 AWS Lambda에서 수많은 매우 불안전한 함수를 배포하고 실행할 수 있는 DHIY직접 배포하고 해킹해보세요 프로젝트입니다. 목표 및 대상 we45에서는 서버리스 보안, 클라우드, 그리고 현대 웹 스택의 보안에 관한 많은 교육을 진행합니다. 우리는 개발자, 아키텍트, DevOps 및 보안 담당자가 이러한 현대적 구성 요소의 위험을 배우고 이해해야 할 필요성이 크다고 굳게 믿습니다. 이 프로젝트는 의도적으로 취약하게 만든 서버리스 앱FaaS을 개발하는 교육 노력의 결정체이며, 이를 더 ...
Gepetto
Gepetto Gepetto is a Python plugin which uses various large language models to provide meaning to functions decompiled by IDA Pro ≥ 7.6. It can leverage them to explain what a function does, and to automatically rename its variables. Here is a simple example of what results it can provide in mere...
PT-2026-83580
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.1 Description Improper escaping of block name, alias, and memo fields occurs within the hint, backlink, and breadcrumb rendering functions. This allows an attacker to inject HTML or script tags into a block's name,...
CVE-2024-23339
...
PoC-CVE-2025-55182
PoC: CVE-2026-33017 Una vulnerabilità di esecuzione remota di codice pre-autenticazione esiste nelle versioni 19.0.0, 19.1.0, 19.1.1 e 19.2.0 di React Server Components, inclusi i seguenti pacchetti: react-server-dom-parcel, react-server-dom-turbopack e react-server-dom-webpack. Il codice...
PowerShell-for-Hackers
Hacker Hak5 dell'anno 2022 Indice 1. Descrizione 2. Le Funzioni 3. Contatti 4. Riconoscimenti Funzioni PowerShell per Hacker 🤓💻 Attualmente sono il contributore di payload numero 1 per Hak5. Ho deciso di creare questo repository per condividere tutte le funzioni che ho ideato per sviluppare i mie...
CVE-2026-82281 Kotaemon Missing Ownership Check in Conversation Functions
Kotaemon through 0.12.0 fails to properly validate conversation ownership in selectconv, deleteconv, renameconv, and onsetpublicconversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation...
EUVD-2026-67812
Kotaemon through 0.12.0 fails to properly validate conversation ownership in selectconv, deleteconv, renameconv, and onsetpublicconversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation...
CVE-2026-82281 Kotaemon Missing Ownership Check in Conversation Functions
Kotaemon through 0.12.0 fails to properly validate conversation ownership in selectconv, deleteconv, renameconv, and onsetpublicconversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation...
CVE-2026-82281 Kotaemon Missing Ownership Check in Conversation Functions
Kotaemon through 0.12.0 fails to properly validate conversation ownership in selectconv, deleteconv, renameconv, and onsetpublicconversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation...
CVE-2026-82281
Kotaemon (by Cinnamon) through 0.12.0 is affected by a missing ownership validation in the select_conv , delete_conv , rename_conv , and on_set_public_conversation functions within libs/ktem/ktem/pages/chat/control.py. An unauthenticated attacker with no privileges required can supply arbitrary c...
CVE-2026-82261
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...
CVE-2026-82260
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...
CVE-2026-82259
SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...
CVE-2026-82261
SvelteKit (@sveltejs/kit) versions >=2.49.0 and
EUVD-2026-67587
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...