598483 matches found
MAL-2026-15818 Malicious code in vitest-cli-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...
Malicious code in vitest-cli-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...
CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction
Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...
CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction
Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...
CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction
Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...
EUVD-2026-69829
Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...
CVE-2026-19754
CVE-2026-19754 is a SQL injection vulnerability in Baserow 2.3.3 , specifically in the index() formula function (used for JSONB array extraction). A low-privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a SQL templa...
CVE-2026-66750-Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-
Avis de sécurité : des contrôles d'accès insuffisants permettent le téléchargement non autorisé de fichiers Let's Chat ID CVE attribué : CVE-2026-66750 Résumé GET /files/:id/:name vérifie que l'appelant est connecté puis sert le fichier. Il ne vérifie jamais si l'appelant est autorisé à voir le...
heaplens
🔎 Heaplens CMPT733 网络安全实验室 II 项目 📂 仓库结构 root@kitploit: . ├── README.md ├── heaplens.png ├── heaplens.py ├── logs │ ├── sudoedit-.txt │ └── ... └── tests ├── Makefile ├── env-in-heap └── ... README.md：就是本文件！ heaplens.py：主脚本 logs/：包含我们在开发和测试过程中捕获的一些示例日志 tests/：包含一些用于测试的二进制文件（及其源代码） 📦 环境...
CVE-2026-84442
A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally...
AZL-98441 CVE-2026-14957 affecting package libreswan 4.15-2
In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...
DEBIAN-CVE-2026-14957
In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...
CVE-2026-14982
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...
CVE-2026-14957
In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...
Spring-Cloud-Function-SpEL
Spring-Cloud-Function-SpEL Подробности можно посмотреть в личном блоге https://pizz33.github.io/ Тестовая среда для инъекции выражения SpEL в Spring Cloud Function Версия java11, запуск: java -jar demo-0.0.1-SNAPSHOT.jar После сборки откройте порт 127.0.0.1:8080 root@kitploit: POST /functionRoute...
NetAlertX v26.9.0
NetAlertX - Network Visibility & Asset Intelligence Framework 📷 Click for more screenshots | | ---|---|--- !presencehttps://assets.kitploit.com/production/public/readmes/295/d2773fcfbdc9d1a31a6e178016e1333b685afe85257bb3...
CVE-2026-19500-poc
CVE-2026-19500 Poc and writeup Description Sureforms is vulnerable to a DOS vulnerability , when attacker can submit unlimited key-value pair, leads to resource exhaustion and the administrator can not watch entries temporary. How to reproduce Submit the Form which is made by Sureforms plugin, an...
CVE-2026-84442 MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal
A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally...
CVE-2026-84442 MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal
A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally...
EUVD-2026-69822
A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally...