CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2026-88914

A flaw in GStreamer's gst-plugins-good isomp4 plugin (qtdemux CEA-608 closed-caption parser) allows an integer overflow in 32-bit unsigned arithmetic to bypass a bounds check when processing a crafted MP4 or MOV file. This results in an out-of-bounds heap read of up to 244 bytes , whose contents ...

ApacheSkywalking

ApacheSkywalking ApacheSKywalking SQLi to Read sensitive file...

grafana-unauth-file-read

grafana-unauth-file-read : CVE-2021-43798 Unauthorized reading of files in Grafana 0day It looks like the new 0day LFI in Grafana exists thanks to the grafana-clock-panel plugin. It is enough to send a GET request of the form: GET /public/plugins/grafana-clock-panel/../../../../../../../etc/passw...

VmWare-vCenter-vulnerability

VMware Vulnerabilites VMware vCenter unauthorized arbitrary file read PoC working to Earlier versions 7.0.2.00100 Shodan Query for Private members only PoC CVE-2021-21972 PoC | VMware Unauthorized RCE CVE-2021-21972 PoC vmware ssrf poc | cve-2021-21975 poc cve-2021-21975 poc cve-2021-22005 poc |...

CVE-2024-46987

CVE-2024-46987 – Camaleon CMS Authenticated Path Traversal / Arbitrary File Read CVE-2024-46987 is an authenticated path traversal vulnerability CWE-22 in Camaleon CMS a Ruby on Rails-based content management system. It allows a logged-in user even with low privileges to read arbitrary files on t...

CVE-2020-1206-POC

CVE-2020-1206 Uninitialized Kernel Memory Read POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes POC to check for CVE-2020-1206 / "SMBleed" Expected outcome: Local file containing target computer kernel memory. Intended only for educational and testing in corporate...

EUVD-2026-75879

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

EUVD-2026-75793

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-77807

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

WinboxPoC

WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. The vulnerability has long since been fixed, so this project has ended and will not be supported or updated anymore. You can fork it and updat...

CVE-2021-28476

CVE-2021-28476: a guest-to-host "Microsoft Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys. This is a proof of concept for CVE-2021-28476 "Hyper-V Remote Code Execution Vulnerability", an arbitrary memory read in vmswitch.sys network virtualization service provider patched by Microso...

PT-2026-90348

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse buf ptr reparse buf ptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparse data buffer u8 io + off; len =...

PT-2026-90347

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

EUVD-2025-210892

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...

PT-2026-90414

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd genl rqstp address fields to sockaddr storage struct nfsd genl rqstp declares rq daddr and rq saddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsd genl rpc status compose msg cast...

PT-2026-90287

In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctl cmd rpc copies cmd-in len bytes into inbuf = kvzalloccmd-in len and passes inbuf and in len to -fw rpc. The CXL callback cxlctl fw rpc ignores in len and never...

PT-2026-90438

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pci write legacy io pci write legacy io loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; retur...

PT-2026-90346

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data offset bound in is valid oplock break Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smb hdr" changed the quantity this bound is measured against. It used to be srv-total read minus the...

PT-2026-90079

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmf sdio read control The memory allocated for buf is not freed in some of the error paths in brcmf sdio read control. Fix that by adding vfree calls. arend: rework as suggested by Johannes...