Sharp-SMBExec

Sharp-SMBExec A native C conversion of Kevin Robertsons Invoke-SMBExec powershell script. https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-SMBExec.ps1 Built for .NET 3.5 Usage Sharp-SMBExec.exe hash:"hash" username:"username" domain:"domain.tld" target:"target.domain.tld"...

CVE-2026-94545

CVE-2026-94545 Next.js next/og Unauthenticated RCE ★ CVE-2026-94545 Next.js next/og SVG injection to native RCE ★ https://github.com/user-attachments/assets/e297b40b-36ad-4a9a-b0c1-a64429bc0160 Overview next/og builds Open Graph images by rendering JSX to an SVG with Satori and then rasterizing...

shARP

|| || /\ | ? | ? || / \ | ? | ? || / \ | ? | ? // ||------- / \ |? |? // || || /--------\ | \ | // || || / \ | \ | // || || / \ | \ | // || || / \ | \ | // || || / \ | \ | Description- ARP spoofing allows an attacker to intercept data frames on a network, modify the traffic, or stop all traffic...

Sharp Multifunction Printers - Directory Listing

It was observed that Sharp printers are vulnerable to an arbitrary directory listing without authentication. Any attacker can list any directory located in the printer and recover any file. id: CVE-2024-33605 info: name: Sharp Multifunction Printers - Directory Listing author: gy741 severity: hig...

next-security-check

next-security-check Check a Next.js project against the October 14, 2026 Next.js security advisories in one command, with no dependencies: CVE-2026-96889 GHSA-2464-fhr4-w9xw: remote code execution in the Image Optimization API with SVG, via sharp critical GHSA-673q-mjm6-r5xr : remote code executi...

sharp-vectorfreed-check

sharp-rsvg-rce-check An offline evidence checker for CVE-2026-96889 / GHSA-wq5f-xc86-pv6w , the librsvg memory vulnerability used through Sharp. It classifies the versions, provenance and configuration that you report; it does not inspect a running system. Contents Scope Requirements Quick start...

Sharp Multifunction Printers - Cookie Exposure

It was observed that Sharp printers are vulnerable to a listing of session cookies without authentication. Any attacker can list valid cookies by visiting a backdoor webpage and use them to authenticate to the printers. id: CVE-2024-33610 info: name: Sharp Multifunction Printers - Cookie Exposure...

CVE-2026-63563

CVE-2026-63563 - Unauthenticated Address Book Modification on Sharp MX/BP Multifunction Printers Vendor advisory: Sharp Product Security Advisory 2026-004 published July 31, 2026 Summary Sharp MX/BP series multifunction printers expose the address book through the device web interface without...

CVE-2026-41551

CVE-2026-41551 Reproduction Vulnerability: Siemens ROS fileserver / fileserver2 service relative path traversal CVSS v3.1: 9.1 AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:N Affected versions: ros-sharp all name.substr10; // remove "package://" std::string package = address.substr0,...

Barco/AWIND OEM Presentation Platform - Remote Command Injection

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pr...

libheif-grid-nextjs-rce

libheif grid-to-GOT Next.js RCE Working proof of concept that turns CVE-2026-32740 in the hardcoded Next.js/sharp image stack into a chosen-address write and a validated /usr/bin/id callback. This is a private Fortbridge research repository. Use it only against the included lab or another system...

code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check

Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid...

GHSA-G6F8-C3X9-JV7F code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check

Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid...

code16/sharp: Arbitrary class instantiation through the embed_key API parameter

Impact An authenticated attacker can instantiate any class in the PHP application by using the embedkey parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the construct method of the class is called and all constructor dependencies are...

GHSA-H24V-F482-8CWF code16/sharp: Arbitrary class instantiation through the embed_key API parameter

Impact An authenticated attacker can instantiate any class in the PHP application by using the embedkey parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the construct method of the class is called and all constructor dependencies are...

CVE-2026-114111

A flaw was found in sharp. The component includes a vulnerable bundled librsvg dependency that is susceptible to memory corruption. An attacker can exploit this issue by providing a specially crafted Scalable Vector Graphics SVG image for processing, which may lead to arbitrary code execution on...

CLSA-2026-1793291148 TuxCare security update for sharp (3 CVEs)

TuxCare rebuilt sharp to address 3 CVEs. Fixed in 0.32.6-tuxcare.1...

CLSA-2026-1792938613 TuxCare security update for gatsby-plugin-sharp (1 CVE)

TuxCare rebuilt gatsby-plugin-sharp to address 1 CVE. Fixed in 2.14.4-tuxcare.1...

Dependency on Vulnerable Third-Party Component

Overview next is a react framework. Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component via the sharp image processing dependency used by next/image. A vulnerable version of sharp is bundled as an optional dependency, and an attacker can exploit a fl...

VulnCheck KEV: CVE-2024-58388

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2024-33605's description was updated to include the impacted endpoint as singular patch addressed both...