990869 matches found
CVE-2026-72567: Improper Limitation of a Pathname to a Restricted Directory
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...
PT-2026-69575
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak exists in the mmiotrace tracer when the trace pipe is closed. The mmio pipe open function allocates a header iter and takes a pci dev reference upon opening the trace pip...
PT-2026-76485
Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...
PT-2026-76480
Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...
PT-2026-76481
Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...
PT-2026-76473
Summary DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletio...
Photon OS 5.0: Open PHSA-2023-5.0-91-0085
An update of the open package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0085. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Open PHSA-2024-5.0-91-0430
An update of the open package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0430. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
HydraDragonAntivirus openedr-demo
Hydra Dragon Antivirus 📚 For detailed documentation, architecture diagrams, and component guides, visit our Project Wiki. WARNING: ACTIVE DEVELOPMENT IN PROGRESS This project is not production-ready. Breaking changes, bugs, and incomplete features should be expected. ⚠️ NOTICE: This repository is...
Eopi-Hunt-Skill
Eopi-Hunt-Skill Authorized security research toolkit comb...
[SECURITY] Fedora 44 Update: bird-3.3.2-1.fc44
BIRD is a dynamic IP routing daemon supporting both, IPv4 and IPv6, Border Gateway Protocol BGPv4, Routing Information Protocol RIPv2, RIPng, Open Shortest Path First protocol OSPFv2, OSPFv3, Babel Routing Protocol Babel, Bidirectional Forwarding Detection BFD, IPv6 router advertisements, static...
Open Notebook CVE-2026-33589 LFI Detect
Detects CVE-2026-33589 in Open Notebook = 1.8.3: POST /api/sources/json accepts type=upload with an unsanitized filepath, allowing arbitrary file read when OPENNOTEBOOKPASSWORD is unset. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open Notebook CVE-2026-33589 unauthenticated LFI via...
CVE-2026-71554 vulnerabilities
Vulnerabilities for packages: mitmproxy, open-webui, airflow...
GHSA-6HR6-W5QG-QMWG vulnerabilities
Vulnerabilities for packages: mitmproxy, open-webui, airflow...
strix v1.5.1
Strix The open-source AI pentesting tool. Autonomous AI hackers that find and fix your app’s vulnerabilities. !TIP New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches...
Crow-Eye v0.12.7
Crow-Eye — Windows Forensics Engine A forensic time machine for Windows. Crow-Eye doesn't just detect — it reconstructs what actually happened on the timeline, from acquisition all the way to a verdict traceable to its source records. Table of Contents Overview ✨ Highlights 👥 Who Crow-Eye Is For ...
malwoverview v8.1.0
Malwoverview !Alt...
asterisk v23.5.0-rc1
The AsteriskR Open Source PBX root@kitploit: By Mark Spencer and the Asterisk.org developer community. Copyright C 2001-2025 Sangoma Technologies Corporation and other copyright holders. SECURITY It is imperative that you read and fully understand the contents of the security information document...
CVE-2026-48120
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...
CVE-2026-59717
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...