CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585

HashiCorp go-getter versions prior to 1.8.10 and go-getter/v2 versions prior to 2.2.5 are vulnerable to a path traversal vulnerability (CWE-22) during S3 and GCS directory downloads. This flaw may allow an attacker to write files outside of the intended destination directory. The vulnerability is...

CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-D0cker

CVE-2026-Pending: Escape de contenedor a través de la vulnerabilidad maskPaths de runC Severidad: Crítica CVSS 9.8 Componente: opencontainers/runc libcontainer Tipo de vulnerabilidad: CWE-59: Resolución incorrecta de enlaces antes del acceso al archivo 'Link Following' 🚨 Resumen ejecutivo Existe...

CVE-2026-24061

CVE-2026-24061 GNU Inetutils telnetd Remote Authentication Bypass Seriously, telnet in 2026? Come on guys, it's time to move on. SSH exists since 1995. 🤦 Description A critical authentication bypass vulnerability in GNU Inetutils telnetd affecting versions 1.9.3 through 2.7. The vulnerability...

CVE-2026-25512

CVE-2026-25512: Remote Code Execution via Command Injection in TNEF Handler - Group-Office CVSS 4.0 Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Table of Contents Summary Affected Versions Technical Details Root Cause Source to Sink Flow Exploitation Automated Exploit...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - Cadena completa n8n Lectura arbitraria de archivos sin autenticación → Forja de token de administrador → Evasión de sandbox → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Crítico Afectado| = 0.211.0 RCE Corregido| 1.121.0 AFR /...

React2Shell-Exploit-CVE-2025-55182

💀 React2Shell Exploit — CVE-2025-55182 ██████╗ ███████╗ █████╗ ██████╗████████╗██████╗ ███████╗██╗ ██╗███████╗██╗ ██╗ ██╔══██╗██╔════╝██╔══██╗██╔════╝╚══██╔══╝╚════██╗██╔════╝██║ ██║██╔════╝██║ ██║ ██████╔╝█████╗ ███████║██║ ██║ █████╔╝███████╗███████║█████╗ ██║ ██║ ██╔══██╗██╔══╝ ██╔══██║██║ ██║...

CVE-2026-Termius

Termius macOS Application Vulnerability Report CVE-2026-Termius Target : Termius macOS Version Tested : Latest as of Jan 2026 Impact : Remote Code Execution RCE, Local Privilege Escalation LPE, App Security Bypass 🚨 Executive Summary Three critical vulnerabilities were identified in the Termius...

PinTheft-go

pintheft-go Go port of pintheft - RDS zcopy double-free LPE. Member of the Dirty Frag vulnerability class. !IMPORTANT Arch Linux is one of the most exposed distributions for this vulnerability, as it is among the few where the RDS module can typically be loaded by default. How it works tl;dr The...

CVE-2026-39387

CVE-2026-39387 — BoidCMS Authenticated File Upload to RCE via Template Injection Description BoidCMS -l -p Arguments Flag| Description| Example ---|---|--- -u, --url| Base URL of the target BoidCMS site| http://target.com -l, --user| Admin username| admin -p, --passwd| Admin password| password123...

CVE-2026-36356

CVE-2026-36356: MeiG Smart FORGESLT711 GoAhead — Unauthenticated OS Command Injection /action/SetRemoteAccessCfg CVE : CVE-2026-36356 CWE : CWE-78, CWE-306 Discoverer : Daniil Gordeev Disclosed : 2026-05-03 Summary The GoAhead web server bundled with MeiG Smart FORGESLT711 4G LTE CPE devices...

apex

Pensar Apex AI-powered penetration testing using autonomous agents — directly in your terminal. Run blackbox and whitebox pentests that explore, reason, and surface real vulnerabilities. Want to run from the cloud or integrate it with your CI/CD? See Pensar Console. Use Cases Developers Run...

Discuz-X5.0-Authentication-Bypass-Exploit-Framework

Discuz! X5.0 Authentication Bypass Exploit Framework ⚡ CVE-2026-49952 | CVSS 9.1 Critical | Version 1.0.0 A professional penetration testing tool designed to identify and demonstrate the critical authentication bypass vulnerability in Discuz! X5.0. 📋 Table of Contents ⚠️ Disclaimer 🔍 Overview 🎯...

Fragnesia-go

fragnesia-go One SA. One byte at a time. No race. Go port of fragnesia CVE-2026-46300. Member of the Dirty Frag vulnerability class - separate bug, same surface, own patch. How it works tl;dr The bug is in the Linux XFRM ESP-in-TCP subsystem. When TCPULP espintcp is installed on a socket after da...

CVE-2026-39813

🛡️ CVE-2026-39813 - Fortinet FortiSandbox Path Traversal Vulnerability 📌 Overview CVE-2026-39813 is a critical path traversal vulnerability affecting Fortinet FortiSandbox. The vulnerability arises due to improper validation of user-supplied file paths, allowing attackers to manipulate directory...

CVE-2026-22243

CVE-2026-22243: EGroupware has SQL Injection in Nextmatch Filter Processing Overview Field| Details ---|--- CVE ID| CVE-2026-22243 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products egroupware/egroupware versions: = 26.0.20251208, 26.0.20260113 CWE Classification...

DirtyFrag-go

dirtyfrag-go Dos bugs. Una shell. Sin escrituras en disco. Puerto en Go de dirtyfrag CVE-2026-43284 / CVE-2026-43500. Cómo funciona tl;dr La clase de bug está en el subsistema XFRM del kernel de Linux. Cuando una página de archivo se pasa con splice a un pipe y luego a un socket cifrado con ESP, ...