CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 is vulnerable to remote code execution (RCE) due to a directory traversal flaw in the /api/documents/upload endpoint. A standard user can exploit this to write a Python .pth file into the site-packages directory. The malicious code within the .pth file is executed automatically d...

EUVD-2026-92275

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

Malicious code in web3-sign-helper (RubyGems)

RubyGems runs this gem's native extension script ext/web3-sign-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17617 Malicious code in web3-sign-helper (RubyGems)

RubyGems runs this gem's native extension script ext/web3-sign-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17597 Malicious code in eth-address-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in eth-address-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

CVE-2019-11395

Exploit CVE-2019-11395 🛡️ Acerca de CVE-2019-11395 🕵️ La vulnerabilidad CVE-2019-11395 describe una vulnerabilidad de desbordamiento de búfer en la aplicación de correo electrónico MailCarrier 2.51, que permite la ejecución remota de código. La vulnerabilidad ocurre en los procesos SMTP RCPT TO,...

CVE-2026-21858

CVE-2026-21858 RCE PoC environment for n8n 1.120.4 with a Form Trigger workflow and an exploit script. Requirements Docker Docker Desktop on Windows Python 3.x attack side Files Dockerfile — build the n8n vulnerable environment run.bat — run the container Windows workflow.txt — n8n workflow...

SSP-Assignment-3-RCEYouLater

CVE-2023-46604: Prueba de Concepto de RCE en Apache ActiveMQ Asignación: SSP Assignment 3 Equipo: RCE You Later Miembros: Banica Horia Alexandru, Comarlau Vlad-Constantin Enlace de video del uso del repositorio para realizar la PoC:https://www.youtube.com/watch?v=vum4qTF4ygU 🚨 Descripción general...

FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit a heap-based buffer overflow vulnerability in the negosendnegotiationrequest function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled LoadBalanceInfo field, the serve...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure

A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol RDP server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This...

CVE-2022-21907-Vulnerability-PoC

CVE-2022-21907 Descripción - POC para CVE-2022-21907: Vulnerabilidad de ejecución remota de código en la pila del protocolo HTTP. - Creado por antx el 2022-01-17, solo algunas pequeñas correcciones de Michele "[email protected]" Detalle - Vulnerabilidad de ejecución remota de código en la...

Stagefright-cve-2015-1538-1

Stagefright-cve-2015-1538-1 Discovered by Joshua J. Drake @jduck of ZIMPERIUM zLabs and fixed his project by Niranjan Shrestha @niranjanshr13. Exploit for RCE Vulnerability CVE-2015-1538 1 Integer Overflow in the libstagefright MP4 'stsc' atom handling Don't forget, the output of "createmp4" can ...

MAL-2026-17561 Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...