CVE-2026-78587 Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations

Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the activ...

EUVD-2026-67076

NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots...

CVE-2026-22812

CVE-2026-22812 Overview A Python exploitation tool for OpenCode Remote Code Execution RCE vulnerability affecting versions v1.0.216. This tool provides multiple attack vectors including command execution, file read/write, file upload/download, and interactive shell. Disclaimer ⚠️ FOR AUTHORIZED...

cve-2026-31431

CVE-2026-31431 This document describes a public Python exploit related to the CVE-2026-31431 vulnerability. The code demonstrates the exploitation of the flaw using primitives from the Linux AFALG subsystem, AEAD cryptographic operations, and memory manipulation via splice, with the goal of...

EUVD-2026-69704

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized...

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations...

CVE-2026-83548

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized...

CVE-2021-3490

The eBPF ALU32 bounds tracking for bitwise ops AND, OR and XOR in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. Compile: gcc -o pwn pwn.c && gcc -o exploit exploit.c...

CVE-2026-73720

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system...

EUVD-2026-69447

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 VMware vSphere Client Unauthorized File Upload to Remote Code Execution RCE The vSphere Web Client HTML5 is essentially an administrative interface that enables management of a vSphere installation. The vSphere Client provides an administrator with access to the key...

CVE-2026-24418

CVE-2026-24418: OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module Overview...

CVE-2021-21975

CVE-2021-21975 VMware vRealize Operations Manager API 서버 측 요청 위조SSRF vRealize OperationsvROps는 퍼블릭 클라우드 모니터링을 통합하면서, 앱부터 인프라까지 AI 기반의 자율적인 IT 운영 관리를 제공하여 VMware Cloud 및 HCI 배포를 최적화, 계획, 확장할 수 있게 해주는 도구입니다. VMware vRealize Operations Manager API 8.4 및 모든 이전 버전은 서버 측 요청 위조SSRF 취약점에 영향을 받습니다. 이 취약점을...

CVE-2021-21972

CVE-2021-21972 VMware vSphere Client 무단 파일 업로드를 통한 원격 코드 실행 RCE vSphere Web ClientHTML5는 본질적으로 vSphere 설치를 관리할 수 있는 관리 인터페이스입니다. vSphere Client는 관리자가 vSphere 서버에 직접 액세스하지 않고도 vSphere의 핵심 기능에 액세스할 수 있게 해줍니다. 관리자는 새 가상 머신을 생성하고 기존 가상 머신 및 해당 리소스를 관리할 수 있습니다. 크로스 플랫폼 웹 애플리케이션으로서 지원되는 다양한 웹 브라우저 버전을 ...

windows-api-function-cheatsheets

Windows API 関数チートシート 連絡先 🌨️ Snowcrash: [email protected] 目次 Windows API 関数チートシート ファイル操作 プロセス管理 メモリ管理 スレッド管理 ダイナミックリンクライブラリ DLL 管理 同期 プロセス間通信 Windows フック 暗号化 デバッグ Winsock レジストリ操作 エラー処理 リソース管理 Unicode 文字列関数 文字列長 文字列コピー 文字列連結 文字列比較 文字列検索 文字分類と変換 Win32 構造体チートシート 一般的な構造体 Win32 ソケット構造体チートシート...

CVE-2026-76111

Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation...

CVE-2026-73653

A flaw was found in Vitest. A remote attacker, by sending specially crafted commands to the Browser Mode API, could bypass file access restrictions. This allows the attacker to read, create, overwrite, or delete arbitrary files on the system where Vitest is running, even when file write permissio...

CVE-2026-76111

Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation...

IRM

IRM-2022 Incident Response Methodologies 2022 CERT Societe Generale with the collaboration of CERT aDvens provides easy to use operational incident best practices. These cheat sheets are dedicated to incident handling and cover multiple fields in which a CERT team can be involved. One IRM exists...

VulnCheck KEV: CVE-2026-83548

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized...