CVE-2025-24813-POC

CVE-2025-24813: Apache Tomcat RCE Proof of Concept This repository provides a controlled, automated environment to demonstrate Remote Code Execution RCE vulnerabilities in Apache Tomcat via CVE-2025-24813. Overview This PoC exploits misconfigured file-based session persistence in Apache Tomcat's...

CLEANSTART-2024-RG44419 When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings

Security vulnerability affects the firefox package. When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings...

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was...

no-defender

DMCA 08/06/24 This project was DMCA'd by some company, so all the releases, sources and everything else was wiped off, but if you still find my project useful or interesting, please leave a star 3. no-defender A slightly more fun way to disable windows defender. How it works There's a WSC Windows...

PT-2026-134231

Name of the Vulnerable Software and Affected Versions sevenz-rust2 versions prior to 0.21.1 Description Extracting a malicious 7z archive allows writing or overwriting files outside the intended destination directory. In src/util/decompress.rs, the decompress impl function calculates the...

CVE-2026-61725: hasenbanck sevenz-rust2: sevenz-rust2 is a Rust-native 7z compressor and `decompress`or

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

BIT-OPENBAO-2026-115356 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

PT-2026-132448

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes...

CVE-2026-110183

PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pgstats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL...

CVE-2026-110183: Exposure of Sensitive Information Through Data Queries

PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pgstats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL...

Linux Distros Unpatched Vulnerability : CVE-2026-107146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session...

DALIBO PostgreSQL Anonymizer information disclosure vulnerability

Versions of DALIBO PostgreSQL Anonymizer prior to 3.3.0 contain an information disclosure vulnerability. This vulnerability stems from static masking and statistical persistence issues; original statistical data remains visible in pgstats until manually or via autovacuum, ANALYZE operations on th...

CVE-2026-107146

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

UBUNTU-CVE-2026-107146

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

CVE-2026-107146

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

CVE-2025-8088-BUILDER-Winrar-Tool

CVE-2025-8088 WinRAR path traversal tool ⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited. A Python script that exploits CVE-2025-8088, a path traversal vulnerability in WinRAR, by generating a malicious archive tha...

CVE-2026-107146 Insufficient session expiration in twofactor_gauthenticator

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

CVE-2026-107146

The twofactor_gauthenticator plugin for Roundcube is vulnerable to insufficient session expiration (CWE-613). The root cause is a lack of server-side session destruction following a failed two-factor authentication (2FA) verification. Consequently, an attacker who possesses a user's password can ...

CVE-2026-107146

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

CVE-2026-107146 Insufficient session expiration in twofactor_gauthenticator

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...