CVE-2026-79725 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-45769 ikev2: unbounded client transform storage can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessi...

CVE-2026-45769

Suricata , a network IDS/IPS/NSM engine, is affected by an unbounded memory growth issue in its IKEv2 parser prior to versions 7.0.16 and 8.0.5 . The parser state can grow without bounds while storing client transforms, meaning repeated crafted UDP traffic may cause excessive memory consumption a...

CVE-2026-45769 ikev2: unbounded client transform storage can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessi...

CVE-2026-81551

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to arbitrarily write to or delete files on shared storage . The CVSS 3.1 score is 8.8 (High) , reflecting network attack vector, low complexity, and high impact...

CVE-2026-9225

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

CollaboratorPlusPlus

CollaboratorPlusPlus NCC Group Plc によってオープンソースとして公開 - http://www.nccgroup.com/ 開発者: Corey Arthur, [email protected] http://www.github.com/nccgroup/CollaboratorPlusPlus このプロジェクトはAGPLのもとで公開されています。詳細はLICENSEを参照してください リリースはこちらからダウンロードできます。 背景 このツールは、Burp...

WMIcmd

问题 在进行低影响调查及其他类似活动时，您可能希望尽量减少写入磁盘的内容/尽量不引人注意。 该工具允许我们通过 WMI 执行命令，并获取通过此通道无法以其他方式获得的信息。 目的 一个仅使用 WMI 的小型实用程序，用于： 执行命令行的 shell 命令 捕获这些命令的 stdout 并将其写入注册表 从注册表读取，然后删除 打印到本地 stdout 设计 该工具由以下部分组成： NCC Group 内部核心库（WMICore）的一个极小子集 命令执行（WMIcmd） 用法 root@kitploit:...

EUVD-2026-75723

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

vcenter_saml_login

vCenter SAML Login Tool Una herramienta para extraer el certificado del proveedor de identidad IdP de las copias de seguridad de vCenter e iniciar sesión como Administrador Antecedentes Comúnmente, durante los compromisos, obtenemos acceso a las copias de seguridad de vCenter en un servidor de...

CVE-2025-60791

CVE-2025-60791 CVE-2025-60791：内存中敏感信息的明文存储。 Easywork Enterprise 2.1.3.354 存在内存中敏感信息明文存储的漏洞。该应用程序在激活尝试失败后，会将有效的设备绑定许可证密钥留在进程内存中。攻击者可通过附加调试器或分析进程/内存转储来获取这些密钥，随后无需购买即可在同一台机器上激活该软件。...

DAMM

DAMM Una herramienta de análisis de memoria de código abierto construida sobre Volatility. Está pensada como un banco de pruebas para técnicas nuevas e interesantes que se pondrán a disposición de la comunidad. Estas técnicas son un intento de acelerar el proceso de investigación mediante la...

passera

注意：我不再有时间继续开发 Passera，但非常欢迎提交拉取请求！最常被要求的功能是更新 Firefox 扩展，因为最近的 API 变更导致当前版本无法使用。 Passera 一个简单的工具，让用户为每个网站设置强而独特的密码，无需在本地或在线服务中存储密码。它可作为 Linux/Mac/Windows 的命令行工具和 Android 应用使用。 Passera 将任何输入的文本转换为长度最多 64 个字符的强密码，并将其复制到剪贴板。为自己设计一个合适的系统，为每个网站生成独特的密码短语，例如将网站名称/URL 与你不会忘记的短语组合起来。要登录时，启动 Passera...

DEBIAN-CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Rails Active Storage/libvips 任意文件读取 → SECRETKEYBASE 窃取 → RCE 概述 CVE-2026-66066 是一个严重级别（CVSS 9.5）的预认证 任意文件读取到远程代码执行链，存在于 Ruby on Rails Active Storage 中，影响默认配置下的 Rails 7.2.0–7.2.3.1 、8.0.0–8.0.5 和 8.1.0–8.1.3 。 该漏洞利用了跨越 Rails、libvips、libmatio 和 HDF5 的四层解析器混淆...

PrivateSphare

PrivateSphare PrivateSphare is a secure, anonymous, zero-knowledge file storage and sharing platform. It allows users to upload files and receive a human-readable 24-word passphrase for retrieval. No accounts, no tracking, and no unencrypted data ever touches the server's persistent storage. 🛡️ Ke...

CVE-2026-4130

There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prio...

CVE-2026-88046

rclone prior to 1.75.1 does not reject parent-directory (..) segments in source Object.Remote() values before they are passed to destination backends via fs/list, fs/walk, fs/sync, or fs/operations. A flat-keyspace source store populated with non-rclone tooling can carry a raw .. key segment, and...

CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

CVE-2026-88016

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...