Langflow < 1.9.0 - Remote Code Execution

Langflow versions prior to 1.9.0 are vulnerable to unauthenticated remote code execution RCE via the buildpublictmp endpoint. Attackers can submit a manipulated flow JSON containing Python code that is executed during the build process without proper sandboxing. id: CVE-2026-33017 info: name:...

ChromeSHELFLoader

Chrome SHELF Loader استغلال لـ CVE-2020-6418 ينفذ محمل SHELF. نُشر كجزء من Tmp.0ut volume 2...

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

CVE-2026-21002 – تسريب بيانات الاعتماد عند بدء التشغيل البارد في Serverless عبر /tmp المُعاد استخدامه كود البرنامج محاكاة Python AWS Lambda lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm starts def handlerevent: On fir...

CVE-2026-41900-POC

OpenLearnX-RCE OpenLearnX ثغرة تنفيذ الأكواد عن بُعد غير المصادق عليها عبر تركيب وحدة تخزين الحاوية اكتشاف قائم على الفروقات ← تصحيح صامت ← هروب من الحاوية ← كشف كامل لـ /tmp الخاصية| القيمة ---|--- الاسم| OpenLearnX-RCE CVE| CVE-2026-41900 GHSA| GHSA-8h25-q488-4hxw النوع| كشف معلومات غير مصادق...

google-osconfig-privesc

ملخص عملية googleosconfigagent هي أحد مكوّنات أدوات GoogleCloudPlatform https://github.com/GoogleCloudPlatform/osconfig الخاصة بها، وتعمل على كل جهاز افتراضي VM بشكل افتراضي. يعمل الوكيل بصلاحيات الجذر root وهو مسؤول عن بعض الخدمات التي يتحكم فيها المستخدم، بما في ذلك OS config...

cve-2022-21658

CVE-2022-21658 poc تأكد من استخدام إصدار Rust 1.58.0. قم أولًا بالتشغيل: while :; do mkdir /tmp/legit; rm -r /tmp/legit; ln -s /tmp/sensitive /tmp/legit; done ثم: cargo run...

Exploit for CVE-2026-61424

CVE-2026-61424 Unauthenticated arbitrary file upload in the D...

CVE-2026-48907

CVE-2026-48907 إثبات المفهوم التعليمي ⚠️ هذا المستودع مخصص لأغراض تعليمية وأمنية دفاعية فقط. اختبر فقط على الأنظمة التي تملكها أو التي لديك إذن صريح بتقييمها. لا تستخدم هذا المشروع ضد أنظمة طرف ثالث. يتناول إثبات المفهوم هذا CVE-2026-48907، وهي ثغرة تنفيذ تعليمات برمجية عن بُعد RCE غير موثّقة تؤثر...

MAL-2026-17604 Malicious code in keccka (RubyGems)

RubyGems runs this gem's native extension script ext/keccka/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and...

MAL-2026-17617 Malicious code in web3-sign-helper (RubyGems)

RubyGems runs this gem's native extension script ext/web3-sign-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Rocky Linux 8 [CIQ] Security Update: socat / socat-debuginfo / socat-debugsource (crlsa-2025_11042)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511042 advisory. socat: arbitrary file overwrite via predictable /tmp directory CVE-2024-54661 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: socat / socat-debuginfo / socat-debugsource (crlsa-2025_10353)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510353 advisory. socat: arbitrary file overwrite via predictable /tmp directory CVE-2024-54661 Tenable has extracted the preceding description block directly from the CIQ security...

Security Bulletin: Vulnerabilities in Netty,Apache Log4j Core,Spring Boot,Spring Framework,PostCSS,tmp,Spring Data,Apache Commons Lang,React Router,Bootstrap,d3-color might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Apache Log4j Core, Spring Boot, Spring Framework, PostCSS, tmp, Spring Data, Apache Commons Lang, React Router, Bootstrap,d3-color. Vulnerabilities include The attacker can present a server certificate...

CVE-2026-101054

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function getfile of the file /tmp/wpasupplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available...

PT-2026-99855

Name of the Vulnerable Software and Affected Versions Thinkware U3000 versions prior to 1.02.04 Description An issue exists in the TCP Service component where manipulating the path argument within the PUT FILE function for the file /tmp/wpa supplicant.conf can lead to improper access controls. Th...

PT-2026-99856

Name of the Vulnerable Software and Affected Versions Thinkware U3000 versions prior to 1.02.04 Description Improper access controls exist within the TCP Service component. A remote attacker can manipulate the get file function associated with the /tmp/wpa supplicant.conf file to gain unauthorize...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2026-054036)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054036 advisory. Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege...

PT-2026-96030

Name of the Vulnerable Software and Affected Versions QCMS versions prior to 6.0.7 Description A remote SQL injection exists in the Content Detail Page component within the self Tmp function located in the Lib/Config/Controllers.php library. The issue occurs when the ID argument is manipulated...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

Astra Linux – Vulnerability in Thunderbird

By creating a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the...