CVE-2026-121549

A flaw was found in nnn. The pdfread and nuke plugins create temporary files in shared directories using predictable file paths. A local attacker can exploit this flaw by pre-creating a symbolic link at the intended location, causing the application to truncate and overwrite arbitrary files...

CVE-2026-121549

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and...

CVE-2026-121549 nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and...

EUVD-2026-115894

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and...

CVE-2026-121549 nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and...

CVE-2026-121549

The nnn utility (versions through 5.3 ) is vulnerable to an insecure temporary file symlink overwrite in its pdfread and nuke plugins. The root cause is the use of predictable paths in the /tmp directory for temporary files. A local attacker can pre-create a symlink at a name-derived or PID-deriv...

CVE-2026-121549: jarun nnn: nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local…

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and...

GEVAUDAN

GEVAUDAN Gluster Environment Vulnerable AUthentication Data Access & Nuke. Getting Started Gevaudan is a Red Hat GlusterFS exploit for CVEs 2018-1088 & 2018-1112. Available in both standalone and metasploit module formats. Presentations | Date| Conference| Link to Video| Link to Slides...

ASP-Nuke - Open Redirect Detection

ASP-Nuke contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """ASP-Nuke contains an open redirect vulnerability."""...

Malicious code in nuke-bot (PyPI)

--- Credit: OpenSSF source...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: nri-haproxy, cass-operator, flannel, terraform-docs, apache-exporter, sigstore-scaffolding, opentofu, tekton-pipelines, zarf, aws-node-termination-handler, redka, kubeflow-katib, ingress-nginx-controller, cloud-provider-aws, crossplane-provider-aws-s3, datadog-agent,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: nri-haproxy, cass-operator, flannel, terraform-docs, apache-exporter, sigstore-scaffolding, opentofu, tekton-pipelines, zarf, aws-node-termination-handler, redka, kubeflow-katib, ingress-nginx-controller, cloud-provider-aws, crossplane-provider-aws-s3, datadog-agent,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: nri-haproxy, cass-operator, flannel, terraform-docs, apache-exporter, sigstore-scaffolding, opentofu, tekton-pipelines, zarf, aws-node-termination-handler, redka, kubeflow-katib, ingress-nginx-controller, cloud-provider-aws, crossplane-provider-aws-s3, datadog-agent,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: nri-haproxy, cass-operator, flannel, terraform-docs, apache-exporter, sigstore-scaffolding, opentofu, tekton-pipelines, zarf, aws-node-termination-handler, redka, kubeflow-katib, ingress-nginx-controller, cloud-provider-aws, crossplane-provider-aws-s3, datadog-agent,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: emqx-exporter-fips, dapr, crossplane-provider-aws-kms-fips, kubelogin, flux-fips, crossplane-provider-aws-route53recoverycontrolconfig, crossplane-provider-azure-operationalinsights, kyverno-policy-reporter-kyverno-plugin-fips, policy-bot, kaniko, knative-serving,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: emqx-exporter-fips, dapr, crossplane-provider-aws-kms-fips, kubelogin, flux-fips, crossplane-provider-aws-route53recoverycontrolconfig, crossplane-provider-azure-operationalinsights, kyverno-policy-reporter-kyverno-plugin-fips, policy-bot, kaniko, knative-serving,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: emqx-exporter-fips, dapr, crossplane-provider-aws-kms-fips, kubelogin, flux-fips, crossplane-provider-aws-route53recoverycontrolconfig, crossplane-provider-azure-operationalinsights, kyverno-policy-reporter-kyverno-plugin-fips, policy-bot, kaniko, knative-serving,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: emqx-exporter-fips, dapr, crossplane-provider-aws-kms-fips, kubelogin, flux-fips, crossplane-provider-aws-route53recoverycontrolconfig, crossplane-provider-azure-operationalinsights, kyverno-policy-reporter-kyverno-plugin-fips, policy-bot, kaniko, knative-serving,...

CVE-2026-43250 usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()

In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in epnuke The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected during an active transfer. This occurs becau...

Flat Nuke 3.1.2 Cross Site Scripting

A cross site scripting vulnerability exists in Flat Nuke version 3.1.2. The vulnerability allows remote attackers to inject arbitrary web script or HTML. This issue is older research added to the archive...