VisiData VisiData EmailSheet extract_parts path traversal vulnerability

Summary A path traversal vulnerability exists in the EmailSheet extractparts functionality of VisiData versions: dev commit 38b21f78. A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability. Confirmed Vulnerable Versio...

PT-2026-107513

Name of the Vulnerable Software and Affected Versions Sungrow iSolarCloud versions prior to 2026 Description An authentication bypass and account takeover issue exists when a login request is made using the login type parameter set to 5. This flaw could potentially lead to local blackouts across...

PT-2026-107718

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

CVE-2026-107102: Insufficient Verification of Data Authenticity

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:4534-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4534-1 advisory. - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined bsc1259611. - CVE-2026-0864...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware

Research on Vivo iQOO Neo 9 Rooting CVE-2025-21479 This pro...

CVE-2024-27954

CVE-2024-27954 - WordPress wp-automatic Plugin LFI Scanner This project provides a Python-based Local File Inclusion LFI vulnerability scanner targeting CVE-2024-27954 , a critical flaw found in the WordPress plugin wp-automatic. The vulnerability allows unauthenticated attackers to read arbitrar...

CVE-2026-89182

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

CVE-2024-13485

CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.7...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182

With "repository FORCEPRIVATE = true", Gitea creates new repositories as private, but the post-receive hook still applied the "repo.private=false" push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

EUVD-2026-94065

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182

A flaw in Gitea allows authenticated users with repository creation privileges to bypass instance privacy policies. When [repository] FORCE_PRIVATE = true is enabled, the post-receive hook incorrectly applies the repo.private=false push option to empty repositories created via push. This allows u...

CVE-2026-105811

Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambdahooks/README.md , available with QnABot on AWS versions 7.0.0 through 7.4.5,...

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

Root Cause File: internal/corazawaf/transaction.go, lines 770–808 since commit 2fd87b89, PR 812, 2023-06-14 go func tx Transaction AddGetRequestArgumentkey string, value string if tx.checkArgumentLimittx.variables.argsGet tx.debugLogger.Warn.Msg"skipping get request argument, over limit" return...

GHSA-6R3Q-MJV7-XR8M Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

Root Cause File: internal/corazawaf/transaction.go, lines 770–808 since commit 2fd87b89, PR 812, 2023-06-14 go func tx Transaction AddGetRequestArgumentkey string, value string if tx.checkArgumentLimittx.variables.argsGet tx.debugLogger.Warn.Msg"skipping get request argument, over limit" return...