20912 matches found
Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
SummaryMicrosoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...
PYSEC-2026-2849 OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
Summary A heap-buffer-overflow OOB read occurs in the istreamnonparallelread function in ImfContextInit.cpp when parsing a malformed EXR file through a memory-mapped IStream. A signed integer subtraction produces a negative value that is implicitly converted to sizet, resulting in a massive lengt...
Litestar and Starlite vulnerable to Path Traversal
SummaryLocal File Inclusion via Path Traversal in LiteStar Static File ServingA Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensiti...
Seg fault in `ndarray_tensor_bridge` due to zero and large inputs
ImpactIf a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. E.g. the following raises an error:pythonnp.ones0, 231, 231An example of a proof of concept:pythonimport numpy as npimport tensorflow as tfinputval =...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2026-23415 PoC Proof...
Exploit for CVE-2026-38526
CVE-2026-38526 - Krayin CRM RCE Description PoC script for...
PT-2026-59370
Summary When setting model permissions so that a group has read access to it, intending for other users to use it, those users also can read the model's system prompt. However users may consider their system prompt confidential, so we consider this a security issue. Compare...
Antiproof: Synthesizing Vulnerability Detectors and Proofs of Exploitability
Discovering vulnerabilities before attackers exploit them requires high recall and reliable automatic validation, but existing approaches struggle to achieve both without prohibitive cost. We present Antiproof, an end-to-end vulnerability discovery system that combines neuro-symbolic detector...
Proof-generation tool XSS
The vulnerability of the proof-generation tool and the software platform based on Git for collaborative code development in GitLab EE is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
GHSA-XX7V-HQXH-CJR9
creationtimestamp| type| source ---|---|--- 2026-07-12 22:00:06+00:00| seen| https://t.me/securixykz/1284 2026-07-13 00:00:16+00:00| published-proof-of-concept| https://t.me/securixykz/1284...
RHSA-2026:2363
creationtimestamp| type| source ---|---|--- 2026-07-12 22:00:05+00:00| seen| https://t.me/securixykz/1317 2026-07-13 00:00:16+00:00| published-proof-of-concept| https://t.me/securixykz/1317...
CVE-2025-38193
creationtimestamp| type| source ---|---|--- 2026-07-12 22:00:05+00:00| seen| Telegram/umj1CdMieItOpyXE7RZ7QaVSEKWw80YJbSGQfu2ETJpxg 2026-07-13 00:00:16+00:00| published-proof-of-concept| Telegram/umj1CdMieItOpyXE7RZ7QaVSEKWw80YJbSGQfu2ETJpxg...
Malicious code in mcp-notes-server-poc-praetorian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...
MAL-2026-10210 Malicious code in mcp-notes-server-poc-praetorian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...
Exploit for Code Injection in Apache Nifi
CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC...
GHSA-PHRQ-PC6R-F6GH
creationtimestamp| type| source ---|---|--- 2026-07-12 13:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/87589 2026-07-13 00:00:43+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/87589...
Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft
PoC for the ThemeBleed CVE-2023-38146 exploit Windows 11 Them...
CVE-2026-36670
creationtimestamp| type| source ---|---|--- 2026-07-12 10:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/88109 2026-07-13 00:00:46+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/88109...
GHSA-8MG2-6588-R4HW
creationtimestamp| type| source ---|---|--- 2026-07-12 09:01:47+00:00| published-proof-of-concept| https://t.me/bdufstecru/3229 2026-07-13 00:00:48+00:00| published-proof-of-concept| https://t.me/bdufstecru/3229...