254 matches found
CVE-2026-23744
usage: exploit.py -h --lhost LHOST --lport LPORT --rhost RHOST CVE-2026-23744 - PoC options: -h, --help show this help message and exit --lhost, -l LHOST Attacker IP address --lport, -p LPORT Attacker port --rhost, -t RHOST Target URL...
EUVD-2026-121146
Eclipse Kura downloads deployment packages DPs from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTPS server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large or endless response. Kura writes the response ...
PT-2026-141718
Eclipse Kura downloads deployment packages DPs from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTPS server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large or endless response. Kura writes the response ...
openjdk-orb: Incomplete fix for CVE-2026-15560,unauthed class loading via IIOP in EAP
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
EUVD-2026-115868
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that...
Malicious code in zystcdemo (npm)
zystcdemo presents itself as a simple date formatting utility and runs its postinstall payload on npm install with node postinstall.js. The payload collects the whoami result, hostname, platform, and current time, then sends them in a POST request to https://srctest.zystcc.cn/collect; npm account...
CVE-2026-84725 Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
PT-2026-129098
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
CVE-2026-84725: Red Hat: when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object…
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
CVE-2026-116044
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the...
CVE-2026-116044 prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the...
CVE-2026-116044
A security vulnerability exists in prasathmani TinyFileManager versions up to 2.6 . The issue is located within an unknown functionality of the tinyfilemanager.php file, specifically affecting the Remote URL File Upload Module . This vulnerability allows for unrestricted upload of files, which ca...
CVE-2026-116044 prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the...
EUVD-2026-109338
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the...
Prasath Mani TinyFileManager permission and access control issue vulnerability
Prasath Mani TinyFileManager versions 2.6 and earlier contain a security vulnerability. This vulnerability stems from unrestricted file upload capabilities in the tinyfilemanager.php file within the Remote URL File Upload Module component, potentially allowing attackers to upload arbitrary files...
PT-2026-122952
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the...
PT-2026-117398
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate remote url in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...
WS-2026-0132
mise 2026.7.11 before 2026.10.11: a mise.toml containing only tasks loads without trust; if one of its tasks sets file to a remote URL, mise tasks ls, mise tasks info and mise tasks validate fetch that file and render its MISE header templates, so a template such as exec... runs commands without ...
Linux Distros Unpatched Vulnerability : CVE-2026-93326
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look lik...
CVE-2026-93326
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, fo...