CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-42048

CVE-2026-42048 CVE-2026-42048 Langflow Path Traversal / Arbitrary Directory Deletion PoC https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de Description CVE-2026-42048 : Langflow Arbitrary Directory Deletion Vulnerability description: A path traversal vulnerability in...

CVE-2025-47176

CVE-2025-47176 PoC Browser Bridge Description This proof-of-concept PoC demonstrates the CVE-2025-47176 vulnerability simulation. It injects a crafted mail item into Outlook containing a malicious sync path that triggers an action during scanning. IMPORTANT: This PoC simulates the vulnerable...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 MiNi Exploitation Framework Command-line automation tool for authorized security testing of Grafana Directory Traversal CVE-2021-43798. Overview CVE-2021-43798 is an unauthenticated directory traversal vulnerability in Grafana 8.x that allows attackers to read...

esm-lfi-poc

esm.sh LFI PoC packages authorized security research Two th...

CVE-2024-0204

CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive This repository contains a proof-of-concept exploit for the authentication bypass vulnerability CVE-2024-0204 discovered in Fortra's GoAnywhere MFT product. The vulnerability allows an unauthenticated attacker to create an...

CVE-2026-105856 Payload: SQL injection in SQLite/Postgres

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operator...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-14532 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a Reader-role attacker to obtain version information that causes an uncaught...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-22356

CVE-2026-22356: Jetpack CRM Path Traversal Vulnerability and RCE Warning: This tool should only be used in authorized test environments. The user is solely responsible for illegal use. 📥 Requirements pip3 install requests urllib3 $ python3 exploit.py https://example.com --rce --cmd "id" + Target ...

GHSA-6GW6-RV2G-25MG Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Impact When generating an API plugin manifest from an attacker-controlled or compromised OpenAPI description, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath into the manifest without validating that it is a safe package-relative file reference. An attacker can supply...

WordPress-Path-Traversal-CVE-2019-11447

Penetration Test Report WordPress Path Traversal - CVE-2019-11447 Document Information Item| Details ---|--- Document Title| Penetration Test Report - WordPress Path Traversal Client/Exam| HackTheBox Lab - CPTS Exercise 1 Date| August 22, 2026 Assessor| Fernando Viana Penetration Tester Assessmen...

CVE-2026-8069

From an Acer Named Pipe to NT AUTHORITY\SYSTEM: CVE-2026-8069 Acer NitroSense and PredatorSense 3.x installed a Windows service called PSSvc that exposed a custom named-pipe protocol to local users. One protocol command accepted a caller-controlled executable path, duplicated the token of...

CVE-2026-105795

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

Vulnerability-CVE-2025-64446-CVE-2025-58034

FortiWeb Exploitation Simulation CVE-2025-64446 & CVE-2025-58034 Note: This document is for educational and security research purposes only. Do not use to attack systems without permission. 1. Overview FortiWeb is a Web Application Firewall WAF device used to protect web applications. In 2025, tw...

linux-kernel-codex-harness

Kernel Codex Harness 한국어 | English Research Tool · Original Import: 3 April 2026 · Documentation Revision: 11 July 2026 Core Philosophy — External Signal Let reproducible observations outside model inference guide attention; never mistake priority for proof. Project status. Этот репозиторий —...

EUVD-2026-93424

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...