Lucene search
+L

15988 matches found

Github Security Blog
Github Security Blog
added 2026/09/09 11:51 p.m.15 views

@openhop/server: Path Traversal in Flow ID File Operations

Path Traversal in Flow ID File Operations Summary @openhop/server passes unsanitized HTTP route parameters directly to path.join when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary .yaml files accessible to the OpenHop...

SaveExploits0References3Affected Software1
RedHat Linux
RedHat Linux
added 2026/09/09 7:45 p.m.7 views

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

7.1CVSS0.00357EPSS
SaveExploits0References9
Kitploit
Kitploit
added 2026/09/09 7:06 p.m.12 views

IOBitUnlockerUnlocker

Intro 0 day Moves or Copies any file. Bypasses previous patch with a checksum trick. Writup: https://nathan2.com/files/iobit.pdf Overall info: https://nathan2.com/posts/iobit/ I discovered this without knowing that this there was another previous exploit that discovered this first. However, this...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/09 5:38 p.m.7 views

CVE-2025-41244-PoC

CVE-2025-41244 PoC VMware Aria Operations &1" VERSIONEND done get-versions.sh 발췌 119-124행: root@kitploit: getversion "/\S+/httpd-prefork|httpd|httpd2-prefork$|\s" -v getversion "/usr/bin|sbin/apache\S" -v getversion "/\S+/mysqld$|\s" -V getversion ".?/\Snginx$|\s" -v getversion...

7.8CVSS7.8AI score0.08438EPSS
SaveExploits3
RedhatCVE
RedhatCVE
added 2026/09/09 4:11 p.m.11 views

CVE-2026-48206

A flaw was found in the Apache Camel JIRA component. Due to improper input validation, non-Camel-prefixed Exchange header constants can bypass the HTTP header filter. This allows a remote attacker, potentially unauthenticated, to supply specific headers and override intended values. Consequently,...

5.3CVSS0.00552EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/09 6:38 a.m.9 views

CVE-2026-22812

CVE-2026-22812 Overview A Python exploitation tool for OpenCode Remote Code Execution RCE vulnerability affecting versions v1.0.216. This tool provides multiple attack vectors including command execution, file read/write, file upload/download, and interactive shell. Disclaimer ⚠️ FOR AUTHORIZED...

8.8CVSS8AI score0.16771EPSS
SaveExploits8
Kitploit
Kitploit
added 2026/09/09 4:02 a.m.10 views

cve-2026-31431

CVE-2026-31431 This document describes a public Python exploit related to the CVE-2026-31431 vulnerability. The code demonstrates the exploitation of the flaw using primitives from the Linux AFALG subsystem, AEAD cryptographic operations, and memory manipulation via splice, with the goal of...

7.8CVSS6.4AI score0.99907EPSS
SaveExploits242
UbuntuCve
UbuntuCve
added 2026/09/09 12:00 a.m.5 views

CVE-2026-82060

In MongoDB, insufficient validation of shard key values during documen...

5.4CVSS0.00236EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/09 12:00 a.m.7 views

UBUNTU-CVE-2026-82060

In MongoDB, insufficient validation of shard key values during documen...

5.4CVSS0.00236EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/08 8:24 p.m.6 views

CVE-2021-3490

The eBPF ALU32 bounds tracking for bitwise ops AND, OR and XOR in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. Compile: gcc -o pwn pwn.c && gcc -o exploit exploit.c...

7.8CVSS6.6AI score0.27477EPSS
SaveExploits7
NVD
NVD
added 2026/09/08 6:20 p.m.6 views

CVE-2026-81823

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...

6.9CVSS0.00224EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/08 6:05 p.m.4 views

CVE-2021-21972

CVE-2021-21972 VMware vSphere Client Unauthorized File Upload to Remote Code Execution RCE The vSphere Web Client HTML5 is essentially an administrative interface that enables management of a vSphere installation. The vSphere Client provides an administrator with access to the key functions of...

10CVSS8.2AI score0.99865EPSS
SaveExploits48
Vulnrichment
Vulnrichment
added 2026/09/08 5:36 p.m.4 views

CVE-2026-81823 AVEVA Pipeline Integrity Monitor Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...

6.9CVSS0.00224EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/08 5:36 p.m.20 views

CVE-2026-81823

CVE-2026-81823 affects AVEVA Pipeline Integrity Monitor , specifically its PIMBoards component. A missing authorization flaw allows an unauthenticated attacker to perform read operations intended only for PIMBoards users, resulting in information disclosure . Write operations are not impacted. Th...

6.9CVSS0.00224EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/09/08 5:36 p.m.37 views

CVE-2026-81823 AVEVA Pipeline Integrity Monitor Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...

6.9CVSS0.00224EPSS
SaveExploits0References3
NVD
NVD
added 2026/09/08 5:18 p.m.4 views

CVE-2026-82067

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

9.2CVSS0.00283EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/08 5:18 p.m.5 views

CVE-2026-78216

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

6CVSS0.00246EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/08 4:56 p.m.9 views

windows-api-function-cheatsheets

Windows API Function Cheatsheets Contact 🌨️ Snowcrash: [email protected] Table of Contents Windows API Function Cheatsheets File Operations Process Management Memory Management Thread Management Dynamic-Link Library DLL Management Synchronization Interprocess Communication Windows Hooks...

6.3AI score
SaveExploits0
EUVD
EUVD
added 2026/09/08 4:42 p.m.6 views

EUVD-2026-72931

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

6CVSS0.00246EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/08 4:12 p.m.5 views

EUVD-2026-72954

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

9.2CVSS0.00283EPSS
SaveExploits0References1
Rows per page
Query Builder