435 matches found
CVE-2022-3168-adb-unexpected-reverse-forwards
Die Reverse-Tunnel-Funktion in Android Debug Bridge adb war anfällig, da sie es bÜsartigen adb-Daemons erlaubte, Verbindungen zu beliebigen Hosts/Ports und Unix-Domain-Sockets auf dem Host zu Üffnen. Fenster des Angreifers wo der schädliche Daemon läuft: root@kitploit: $ ./adbroguedaemon.py Fenst...
CVE-2026-67340_exploit
CVE-2026-67340 â ArcadeDB JAVASCRIPT-Trigger-Skript-RCE nach Authentifizierung Remote-CodeausfĂźhrung nach der Authentifizierung in ArcadeDB einer Java-Multi-Model-Datenbank Ăźber einen JAVASCRIPT-Trigger , der Host-Klassen erreicht. Die GraalVM-Polyglot-Engine eines Triggers wird mit einer...
cornershot
What is CornerShot In warfare, CornerShot is a weapon that allows a soldier to look past a corner and possibly take a shot, without risking exposure. Similarly, the CornerShot package allows one to look at a remote hostâs network access without the need to have any special privileges on that host...
CVE-2026-58138-Conductor-Unauth-RCE
CVE-2026-58138 â Conductor Unauthentifizierte RCE Ăźber INLINE GraalVM Evaluator Conductor OSS / Orkes3.21.21 ⌠vor 3.30.2 wertet benutzerbereitgestelltes JavaScript in INLINE und LAMBDA / DOWHILE / SWITCH Aufgaben mit einem GraalVM-Kontext aus, der mit vollem Host-Zugriff HostAccess.ALL erstellt...
CVE-2026-77085
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...
EUVD-2026-63273
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...
CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...
CVE-2026-77085
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool . The tool used a raw HTTP client to send requests to a user-supplied API URL, bypassing n8n's centralized SSRF protection. On instances with N8N_SSRF_PROTECTION_ENABLED=true, an authenticated ...
EUVD-2026-62275
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...
PT-2026-77240
Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An issue exists where missing authorization allows an attacker with access to a mapped host to read from or write to LUNs Logical Unit Numbers, which are unique identifiers used to...
CVE-2026-19050
The CVE concerns the ProSolution WP Client WordPress plugin prior to version 2.0.9. The underlying issue is that the plugin does not validate a user-supplied URL and does not check requester capability or nonce before performing a server-side HTTP request. This allows any authenticated user (e.g....
CVE-2026-73218
Cursor for macOS prior to 3.0.0 is vulnerable to a sandbox escape: an agent in Auto-Run Sandbox mode, with Docker Desktop and the Dev Containers CLI installed, can launch a privileged container and mount Dockerâs virtiofs0. This grants read/write access to the userâs home directory and enables ho...
CVE-2026-72606
A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...
PT-2026-70108
An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...
Astra Linux â Vulnerability in Flatpak
Flatpak is a Linux application sandboxing and distribution framework. Prior to version 1.16.4, the Flatpak portal allowed paths in the sandbox-expose options, which could be app-controlled symbolic links pointing to arbitrary paths. Flatpakâs âflatpak runâ command mounted the resolved host path i...
[SECURITY] Fedora 43 Update: freeipa-4.13.2-1.fc43
IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...
Ghost: Server-Side Request Forgery in Image Fetching
Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...
CVE-2026-58075
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally...
Incorrect Behavior Order: Validate Before Canonicalize
Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the request URI handling. An attacker can access resources on hosts that should have been excluded by bypassing host-based access controls through manipulation of noncanonical...
EUVD-2026-52188
A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...