18415 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-94448
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now...
CVE-2025-32433
Security research on Erlang/OTP SSH CVE-2025-32433 Python exploit Proof-of-Concept CVE-2025-32433 Unauthenticated Remote Code Execution in Erlang/OTP SSH. I also have a banner grabbing Nuclei template and a Nuclei RCE check. The Suricata and Zeek IDS logs are in order based on a succesful Paramik...
CVE-2026-94448
A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...
CVE-2024-39700-PoC
CVE-2024-39700 Proof of Concept Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. PoC PR: https://github.com/LOURC0D3/CVE-2024-39700-PoC/pull/2 Commit Action Result:...
EXPLOIT-CVE-2026-87902
Lab + Exploit — CVE-2026-87902 Lab deliberately vulnerable + Python PoC for CVE-2026-87902 : unauthenticated path traversal in the page template resolution of WordPress Core , leading to Local File Inclusion LFI and conditional RCE. Field| Value ---|--- Product| WordPress Core Affected versions|...
CVE-2023-37979
CVE-2023-37979 Exploit CVE ID| CVSS Score| Discovered| Affected Plugin| Vendor| Vulnerability Type ---|---|---|---|---|--- CVE-2023-37979| | 27/07/2023| WordPress Plugin| Ninja-forms| Reflected XSS 🐍 Python Script This Python script exploits the reflected Cross-Site Scripting XSS vulnerability...
Gitea-Forgejo-CVE-2025-68937
Arbitrary template expansion vulnerability in Gitea and Forgejo This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Summary While checking Forgejo's and Gitea's source code to better understand how templating is performed, I discovered a vulnerability...
CVE-2025-69604
CVE-2025-69604 Description This vulnerability is similar to the one that is described in CVE-2025-61229 – an attacker can edit the task template to get SuperDuper backup tasks to install an arbitrary package. The package can then run shell scripts as the root user and with the highest level of...
DEBIAN-CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...
AZL-107469 CVE-2026-94448 affecting package golang 1.26.7-1
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...
DEBIAN-CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...
AZL-107499 CVE-2026-94448 affecting package golang 1.27.1-1
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...
CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...
CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...
CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...
CVE-2026-97030 Recognize yield as regexp preceder keyword in html/template
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...
CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...
CVE-2026-97030
The html/template package in Go is affected by an issue where the 'yield' keyword, when used as a regexp preceder keyword, might not be correctly escaped in templates authored by a trusted source. The vulnerability arises from inconsistent escaping logic for valid versus non-keyword uses. Remedia...
CVE-2026-94448
The html/template package in Go is vulnerable because the context tracking state was not properly reset when a JavaScript template literal contained consecutive expressions. This flaw prevents subsequent regular expression literals from being accurately recognized and escaped. The fix ensures tha...
CVE-2026-94448 Reset context tracking on consecutive template expressions in html/template
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...