ROOT-APP-GOBINARY-CVE-2025-22872 CVE-2025-22872 in golang.org/x/net - Patched by Root

Root has patched CVE-2025-22872 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-CG2G-XH64-V4Q7 GHSA-cg2g-xh64-v4q7 in dompurify - Patched by Root

Root has patched GHSA-cg2g-xh64-v4q7 in the dompurify package for Root:npm. Multiple fixed versions available...

nessus-metasploit-lab

Découverte et Exploitation de Vulnérabilités — Nessus & Metasp...

ROOT-OS-DEBIAN-12-CVE-2026-41080 CVE-2026-41080 in expat - Patched by Root

Root has patched CVE-2026-41080 in the expat package for Root:Debian:12. Multiple fixed versions available...

Exploit for CVE-2026-98432

CVE-2026-98432 lab root-shell kit This kit builds a deliber...

ROOT-APP-PYPI-GHSA-6V7P-G79W-8964 GHSA-6v7p-g79w-8964 in msgpack - Patched by Root

Root has patched GHSA-6v7p-g79w-8964 in the msgpack package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-HQ85-5CPJ-MR62 GHSA-hq85-5cpj-mr62 in uv - Patched by Root

Root has patched GHSA-hq85-5cpj-mr62 in the uv package for Root:PyPI. Multiple fixed versions available...

Exploit for CVE-2026-98260

CVE-2026-98260 — Analysis of temporary root access and vendor...

dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...

dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...

util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

Exploit for CVE-2026-98432

CVE-2026-98432 Health Check / Fix Script A batch health check...

dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...

dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...

Exploit for CVE-2026-98432

cve-2026-98432-check Read-only shell check for whether a Linu...

CVE-2026-77878: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API…

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77880: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API…

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77877: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows…

Control Web Panel CWP before webpanelversion 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

PT-2026-135486

Control Web Panel CWP before webpanel version 1.29 contains an OS command injection vulnerability in the loopback API /valid token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers...

CVE-2026-119740: Nexbox A95X: Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal…

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...