PT-2026-91202

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been made publi...

PT-2026-91240

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...

CVE-2026-89329

A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...

Medium: nodejs24

Issue Overview: Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function's regex replacement and string-manipulation logi...

CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

Amazon Linux 2 : libvirt (ALAS-2026-3910)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3910 advisory. A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RP...

Amazon Linux 2 : cups-filters (ALAS-2026-3901)

The version of cups-filters installed on the remote host is prior to 1.0.35-26. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3901 advisory. A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installi...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-2159)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2159 advisory. A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper bounda...

Amazon Linux 2 : gegl (ALAS-2026-3911)

The version of gegl installed on the remote host is prior to 0.2.0-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3911 advisory. GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...

TencentOS Server 4: util-linux (TSSA-2026:0999)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0999 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Important: libvirt

Issue Overview: A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can...

CVE-2023-50461

CVE-2023-50461 affects the direct_mail (Direct Mail) extension through version 9.5.1 for TYPO3 . The Configuration backend module allows an authenticated backend user with access to that module to write arbitrary page TSConfig for folders configured as Direct Mail. This leads to Configuration Inj...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2141)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2141 advisory. Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec...

Amazon Linux 2 : gimp (ALASGIMP-2026-020)

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-020 advisory. GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

PT-2026-91137

👉🏽 New JFrog Security Research: ParaShells CVE-2026-90894 A vulnerability in Parallels Desktop for Mac allows a standard, non-admin local user to escalate privileges to root in seconds. 🤯 The exploit uses argument injection against macOS tar via a world-writable Unix socket managed by the prl disp...

poc-CVE-2019-9053

PoC CVE-2019-9053 - CMS Made Simple SQL Injection Educational PoC in Python 3 for CVE-2019-9053, a time-based blind SQL Injection vulnerability in CMS Made Simple = 2.2.9. This version has been modified for use in CTF/lab environments. It includes pre-configured prefixes to reduce extraction time...

CVE-2024-36971

CVE-2024-36971 — Proof of Concept Research & Analysis Only ⚠️ DISCLAIMER — READ BEFORE USING THIS REPOSITORY This repository is intended only for defensive research, analysis, and responsible reporting. It contains a non-exploitable proof of concept file named CVE-2024-36971 and a publicly...

martian-packets

Martian Packets A repo containing a python script which can be used to craft raw TCP/IP packets. Used for testing out martian packets following a vulnerability announced in kubernetes kube-proxy: CVE-2020-8558. This PoC covers the pod - node host localhost boundary bypass. For a simple and robust...

DotCMS-CVE-2022-45782

CVE-2022-45782 – dotCMS Password Reset Token Predictability PoC This repository contains a proof-of-concept exploit for CVE-2022-45782, a vulnerability in dotCMS where password-reset tokens are generated using the non-cryptographic method RandomStringUtils.randomAlphanumeric. Because this token i...

CVE-2026-14266

CVE-2026-14266 — 7-Zip XZ Decoder Heap Buffer Overflow Critical Severity | CVSS: 8.8 High | CWE-122: Heap-based Buffer Overflow Affected: 7-Zip ≤ 26.01 | Patched: 7-Zip 26.02 2026-06-25 Discovered & Analyzed by: Li Yuxuan liyuxuan504-byte and team Executive Summary A heap buffer overflow exists i...