CVE-2021-3310

CVE-2021-3310 Western Digital MyCloud PR4100 – Schwachstelle zur Offenlegung von Informationen durch Linkauflösung Verwenden Sie die enthaltenen Dateien, um die Schwachstelle auf mycloud OS 3 auszulösen; in OS 5 wurde sie behoben...

GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

CVE-2026-81697

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

EUVD-2026-67094

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

EUVD-2026-67053

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2020-8277

CVE-2020-8277 Solo per scopi educativi. Esecuzione rapida root@kitploit: clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" versio...

CVE-2026-72814

A flaw was found in actix-files. When a non-existing folder is provided as the servefrom argument to Files::new, the service incorrectly resolves request paths as relative to the application's working directory. This allows an attacker to access unintended files, leading to information disclosure...

CVE-2025-32463

CVE-2025-32463 शोषण --- प्रूफ-ऑफ-कॉन्सेप्ट PoC अस्वीकरण: इस रिपॉजिटरी में एक प्रूफ-ऑफ-कॉन्सेप्ट शामिल है जो केवल शैक्षिक, रक्षात्मक अनुसंधान और अधिकृत पैठ परीक्षण के लिए है। उन सिस्टमों पर इस कोड का उपयोग न करें जिनके आप मालिक नहीं हैं या जिनके परीक्षण के लिए आपके पास स्पष्ट लिखित अनुमति नहीं है।...

CVE-2026-26030-Microsoft-Semantic-Kernel-1.39.4-RCE

Microsoft Semantic Kernel 1.39.4 – रिमोट कोड एक्ज़ीक्यूशन PoC CVE-2026-26030 InMemoryVectorStore में अविश्वसनीय फ़िल्टर एक्सप्रेशन असुरक्षित एट्रिब्यूट रिज़ॉल्यूशन की अनुमति देते हैं, जिससे builtins / globals ट्रैवर्सल के माध्यम से मनमाना Python कोड एक्ज़ीक्यूशन संभव होता है। 👤 लेखक Mohammed Idre...

CVE-2026-59278 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

CVE-2026-59278

Spring for Apache Kafka is vulnerable to SSRF via DNS resolution in its JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper classes. Because java.net is included in the default trusted packages list, an external Kafka producer can inject a java.net.InetAddress type through the spring_json_header_t...

zig-pe

zig-pe Caricatore PE riflessivo scritto in Zig. Carica ed esegue file PE nativi e .NET direttamente dalla memoria. Caratteristiche Pipeline di caricamento PE Analizza header DOS e NT PE32 e PE32+ a runtime Mappa le sezioni nella memoria allocata Risolve le importazioni per nome e ordinale, thunk...

SSRF-CVE-2020-15002

Краткое описание Логика проверки URL, применяемая при обработке /appsuite/api/oxodocumentfilter&action=addfile, имеет три дефекта, которые могут быть использованы для выполнения атаки SSRF типа «время проверки — время использования» ToCToU. Эта проблема позволяет злоумышленникам выполнять HTTP...

EUVD-2026-66823

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

susvibes-jupyter-server-cve-2026-35397

SusVibes-Benchmark-Aufgabe: Pfadauflösung des Jupyter-Server-Inhaltsverzeichnisses Dieses Repository enthält eine vollständige SusVibes-ähnliche Benchmark-Aufgabe, die aus einem echten Python-Sicherheitsfix im Jupyter Server erstellt wurde. Die Aufgabe soll bewerten, ob ein Agent die maskierte...

retryabledns

पुनः प्रयास योग्य DNS रिज़ॉल्वर miekg/dns पर आधारित और bogdanovich/dnsresolver से प्रेरित। विशेषताएँ सिस्टम डिफ़ॉल्ट DNS रिज़ॉल्वर और उपयोगकर्ता द्वारा प्रदान किए गए दोनों का समर्थन करता है I/O त्रुटियों, टाइमआउट या नेटवर्क विफलताओं के मामले में DNS अनुरोधों को पुनः प्रयास करता है मनमाना क्वेरी...

CVE-2026-81486 bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

EUVD-2026-66833

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

CVE-2026-81486

bsmi021 mcp-file-context-server 1.0.0 contains a path traversal vulnerability in the Path Resolution component, specifically in the function read_context within src/index.ts. Manipulating the path argument allows an unauthenticated remote attacker to read files outside the intended directory, res...