329541 matches found
CVE-2026-106764
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function...
CVE-2026-106765
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function...
CVE-2021-26855-CVE-2021-27065
CVE-2021-26855-CVE-2021-27065 analytics ProxyLogo Mail exchange RCE...
CVE-2026-103441
CVE-2026-103441: Wikibase serialized entity object injection Reporter: Marco Paciaroni BomboBombone. The public action=parse API accepted PHP-serialized Wikibase entities. Unrestricted object construction could reach a Smarty destructor that unlinks a caller-selected path. Available PHP gadget...
CVE-2024-25180
CVE-2024-25180 Overview pdfmake is a pure JavaScript client/server PDF printing library. The affected versions of this package are vulnerable to arbitrary code injection. An attacker can execute arbitrary code by sending a crafted POST request to the /pdf path. The attacker can execute arbitrary...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell — CVE-2026-109618 / CVE-2026-109619 Pre-auth Remote...
cve-2021-41773-v-
Apache httpd RCE A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside these directories are not protected by default...
weblogic-cve-2018-2628
weblogic-cve-2018-2628 weblogic-cve-2018-2628-exp python2 weblogic-cve-2018-2628-exp.py targetip targetport ysoserial-0.1-cve-2018-2628-all.jar bindip bindport JRMPClient python weblogic-cve-2018-2628-exp.py weblogic-server 7001 ysoserial-0.1-cve-2018-2628-all.jar hacker-server 2333 JRMPClient ja...
itsm-exploit
Exploits for Ivanti Neurons for ITSM On Premise This script exploits several flaws that allow an unauthenticated attacker to gain administrator access and execute remote commands CVE-2023-46808 on Ivanti Neurons for ITSM On Premise. For technical details, see Technical Details Affected versions...
EUVD-2026-109060
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename extracts the destination filename from a server-supplied Content-Disposition response header and passes it directl...
CVE-2026-46652 Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename extracts the destination filename from a server-supplied Content-Disposition response header and passes it directl...
CVE-2026-46652 Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename extracts the destination filename from a server-supplied Content-Disposition response header and passes it directl...
CVE-2026-46652
The Goobi viewer web application is vulnerable to a path traversal flaw in versions 24.03 to before 26.05 . The root cause exists in ExternalFilesDownloader.getFilename(), which extracts a filename from a server-supplied Content-Disposition response header and passes it to Path.resolve() without ...
php: fatal error handling retains stale request state leading to use-after-free
A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...
CVE-2022-26809-RCE
CVE-2022-26809-RCE CVE-2022-26809-RCE https://satoshidisk.com/pay/CFGspB...
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code...
CVE-2023-38408
Reference / info https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-remediate Is your PHP exposed to CVE-2026-109618...
CVE-2022-46169
CVE-2022-46169 This repository contains a Proof of Concept PoC for CVE-2022-46169 - Unauthenticated RCE on Cacti = 1.2.22 by chaining an Authentication Bypass and a Command Injection, described by Sonar in this blog post. The same vulnerabilities were also discovered by: Steven Seeley mrme of...