Security Advisory Ivanti Endpoint Manager (EPM) August 2026

Security Advisory Ivanti Endpoint Manager Multiple CVEs Summary: Ivanti has released updates for Ivanti Endpoint Manager EPM which addresses three high severity vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability...

DEBIAN-CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

EUVD-2026-108025

Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. countminsketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...

CVE-2021-1961

Exploit code for CVE-2021-1961. Full write-up is available on my blog. In order to build the exploit, run Android NDK's ndk-build. In order to run the exploit, you need to have access to /dev/qseecom, which means having the right user/group and the right SELinux context. This can be done either o...

CVE-2019-9702_Symantec_Encryption_Desktop_LPE_PoC

Symantec Encryption Desktop PGPwded.sys local privilege escalation PoC This repository contains a proof-of-concept for a local privilege escalation path in Symantec Encryption Desktop's PGPwded.sys storage filter, based on a low-privileged raw disk read/write primitive. The PoC was developed and...

CVE-2021-43798

CVE-2021-43798 1. Summary Grafana is an open-source platform that supports data monitoring and management. In the versions listed below, a Path Traversal vulnerability exists that allows manipulation of file paths using special characters such as ../. 8.0.0 and above, below 8.0.7 8.1.0 and above,...

CVE-2021-26086

CVE-2021-26086 Atlassian Jira Server/Data Center 8.4.0 - Limited Remote File Read/Include Vulnerable Endpoints: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties...

CVE-2025-70828

CVE-2025-70828 Summary An arbitrary file read vulnerability was discovered in Datart v1.0.0-rc.3. The application fails to properly validate the JDBC connection URL during data source configuration. Vulnerability Details Vulnerability Type: Improper Input Validation CWE-20 / Arbitrary File Read...

CVE-2014-4378

CoreGraphics Information Disclosure - CVE-2014-4378 This article explores the exploitability of MobileSafari on IOS 7.1.x. Using a crafted PDF file as an HTML image makes it possible to leak information about the memory layout to the browser Javascript interpreter. Apple CoreGraphics library fail...

CVE-2025-46819

CVE-2025-46819 – Redis Lua Long-String Delimiter Out-of-Bounds Read Malformed long-string delimiter causing Lua lexer OOBs read on Redis 8.2.1. Overview Lua's long-string parser in Redis 8.2.1 mishandles malformed =... sequences, returning sentinel values that lead to buffer underflows or excessi...

zephyr-lwm2m-firmware-update-oob-read-cve-2026-10672-truncated-package-uri

CVE-2026-10672 — Zephyr LwM2M Firmware Update OOB Read PoC Proof of concept for CVE-2026-10672 , an out-of-bounds read in Zephyr RTOS's LwM2M firmware-update pull client subsys/net/lib/lwm2m/lwm2mpullcontext.c. Vulnerability CVE : CVE-2026-10672 CVSS : 8.2 High...

CVE-2026-47729

🦑 CVE-2026-47729 - Squidbleed ⚠️ Heartbleed's ancient cousin, hiding in Squid since 1997. ✨ Features Single-file PoC — Zero dependencies Malicious FTP server mimicking NetWare banner + truncated LIST response Real-time detection and decoding of Basic Auth + Bearer tokens Multi-threaded heap...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

jira-mobile-ssrf-exploit

CVE-2022-26135 - Full-Read Server Side Request Forgery in Mobile Plugin for Jira Data Center and Server About Assetnote Assetnote automatically maps your external assets and monitors them for changes and security issues to help prevent serious breaches. This research was performed by Assetnote's...

badBANANA-threat-observatory

badBANANA // THREAT OBSERVATORY Inspect exploited vulnerabilities and threat indicators, check their source evidence, and review retained changes. Open the live Observatory · Try the KEV walkthrough · Source coverage · Run it yourself The Observatory brings CISA KEV, ThreatFox, URLhaus, and...

CVE-2026-57830

Helix Ultimate Framework — Unauthenticated Path-Traversal Arbitrary File/Folder Read+Delete This is a confirmed DoS + cross-tenant filesystem access vulnerability, NOT RCE. An RCE-escalation theory delete configuration.php to re-expose the Joomla installer was tested live and disproved — see "RCE...

CVE-2022-44268

CVE-2022-44268 🧙‍♂️ CVE-2022-44268 ImageMagick Arbitrary File Read - Proof of Concept exploit Video 📼 https://youtu.be/quKxwNAMBIA Usage 🛠 Poison the image ☣️ python3 CVE-2022-44268.py --image imagetopoison.png --file-to-read /etc/hosts --output poisoned.png Upload poisoned PNG image. Check if...

CVE-2019-19012

CVE-2019-19012 An integer overflow in the searchinrange function in regexec.c in Oniguruma 6.x before 6.9.4rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. This only affects the 32-bit compiled version. Remote attackers can cause a...

CVE-2025-21333-POC

CVE-2025-21333-POC Proof of Concept that exploits CVE-2025-21333 in vkrnlintvsp.sys not so reliable see Requirements and Limitations section. Under the References section are located very helpful resources for who wants to play with the exploit. A detailed analysis of the vulnerability and the...

CVE-2020-15368

How to exploit a vulnerable windows driver Exploit and Proof of Concept PoC for CVE-2020-15368. Asrock repackaged rweverything driver for their RGB controller configuration tool and signed it. They "protect" it by encrypting their ioctls...lol. We found this CVE by accident last summer, and afaik...