Exploit for Use After Free in Redis

redis-server from 7.2.0 until 8.6.3, the Remote Code Execution...

CVE-2026-35193

A flaw was found in Django. This vulnerability allows a remote attacker to read private cached responses. This occurs because the UpdateCacheMiddleware in Django does not correctly add the Authorization header to the Vary response header for requests that include an Authorization header but lack...

Remote Code Execution (RCE) via Insecure Deserialization of Triggers/Exceptions in BaseSerialization

This report is not public...

ALPINE-CVE-2026-24031

Dovecot SQL based authentication can be bypassed when authusernamechars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear authusernamechars. If this is not possible, install latest fixed version. No publicly available exploits...

CVE-2026-32765

This repository is no longer public...

CVE-2026-32764

This repository is no longer public...

Unauthenticated remote shutdown in nltk.app.wordnet_app

Summary nltk.app.wordnetapp allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os.exit0, resulting in a denial of service. Details The...

Integer Overflow Bypasses Memory Safety Checks in H5 Dataset Loading

This report is not public...

Path Traversal via Incorrect startswith() Root Directory Check in jupyter-server Allows Access to Sibling Directories

This report is not public...

Git Argument Injection via Reference Field in GitHubRepository Block

This report is not public...

Exploit for Improper Privilege Management in Microsoft

Security Vulnerability CVE-2026-21533 Overview A HIGH v...

Hardcoded trust_remote_code=True in Model Implementations Bypasses User Security Control

This report is not public...

Arbitrary File Read via Log Symlink following in FileTaskHandler

This report is not public...

Redis: undisclosed vulnerability (ZAI-2026-MIE16I)

Not disclosed. Details are not yet publicly disclosed...

JeecgBoot: undisclosed vulnerability (ZAI-2026-SYBBIU)

Not disclosed. Details are not yet publicly disclosed...

Command Injection through bash -c

This report is not public...

Job API exposed without authorization

This report is not public...

Tracing + Assessments Access

This report is not public...

Arbitrary file write via tar traversal

Summary A crafted tar.gz passed to MLflow pyfunc extraction is unpacked with tarfile.extractall without path validation. Archive entries containing .. or absolute paths can escape the destination directory and write arbitrary files on the host. This is reachable when users supply prebuiltenvuri o...

MLflow SageMaker Command Injection Vulnerability

Description The vulnerability exists in /mlflow/sagemaker/init.py at lines 161-167, where user-supplied container image names are directly interpolated into shell commands without proper sanitization before being passed to os.system. Vulnerable Code Path : CLI Input --container parameter ↓...