kernel: sctp: fix auth_hmacs array size in struct sctp_cookie

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An incorrect array size calculation for the authhmacs field within the sctpcookie structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...

RLSA-2026:65897 Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 For more details about the security issues, including t...

qt5-qtbase security update

An update is available for qt5-qtbase. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Qt is a software toolkit for developing applications. The qt5-base package...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Resumen Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2022-46364 , una vulnerabilidad de Inclusión de Archivos Locales LFI en Apache CXF. La vulnerabilidad surge debido al manejo inadecuado de los elementos XOP XML-binary Optimiz...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 A Python-based security tool to detect and exploit an arbitrary file read vulnerability in the WordPress WP File Upload plugin versions = 4.24.11...

CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...

Cleo Harmony < 5.8.0.21 - Arbitary File Read

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution. id: CVE-2024-50623 info: name: Cleo Harmony 5.8.0.21 - Arbitary File Read author: DhiyaneshDK severity: high...

Adobe ColdFusion - Arbitrary File Read

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...

CVE-2026-18386

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backupfile' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

CVE-2026-15019

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - Auth bypass extract admin users and LDAP config - This PoC do only read-only actions. Run exploit root@kitploit: USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com Run nuclei template root@kitploit: echo https://target.com | nuclei...

CVE-2020-1938

Declaración：所有网络安全工具的使用必须遵守国家法律法规、行业规范及目标系统的相关规定，不得用于任何非法或侵犯他人合法权益的用途。‌ 使用者应认识到，任何工具均无法保证绝对安全，不当使用可能导致法律风险、技术反制或数据污染。使用者需自行承担因违反本声明及相关规定而产生的全部责任。 Requisito：python3 Ejecución： python CVE-2020-1938.py your-ip -p 8009 -f WEB-INF/web.xml...

CVE-2026-15019

Direct Download for WooCommerce (WordPress plugin) is vulnerable to directory traversal via the file_id path segment in the top-level include function, affecting all versions up to and including 1.19 . The root cause is that the product ownership check only verifies that some free, virtual, downl...

CVE-2026-15019 Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2026-18386

The WP BackItUp Community Edition WordPress plugin (all versions up to and including 2.1.0 ) is vulnerable to directory traversal via the backup_file parameter in its download handler. The root cause is that the basename() normalization only executes when the traversed target path does not exist,...

EUVD-2026-75237

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backupfile' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

CVE-2026-18386 WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backupfile' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...