truegaze

truegaze A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only...

qiling

Qiling's use case, blog and related work Qiling is an advanced binary emulation framework, with the following features: Emulate multi-platforms: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR. Emulate multi-architectures: 8086, X86, X8664, ARM, ARM64, MIPS, RISC-V, PowerPC. Support multiple...

wordpress-true-ranker-cve-2021-39312

WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read Python proof-of-concept for CVE-2021-39312 , affecting The True Ranker seo-local-rank WordPress plugin versions ≤ 2.2.2. Vulnerability Details CVE: CVE-2021-39312 Type: Arbitrary File Read Affected Plugin: The True Ranker Affected...

CVE-2026-5059-poc

Where is CVE-2026-5059 in the code? The vulnerability is in two files working together: File 1: tools.py — The Root Cause The old version used shell=True in executepipedcommand: python OLD VULNERABLE CODE process = subprocess.run command, ← raw string passed to shell shell=True, ← THIS is the...

CVE-2026-115726

The AI coding tool Aider (versions through 0.86.2) is vulnerable to command execution via the repository-level .aider.conf.yml file. The root cause is the automatic loading of this configuration file without a trust prompt. Attackers who can commit a malicious .aider.conf.yml can set notification...

CVE-2026-115726 Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=Tr...

EUVD-2026-90872

next.js cache leak across root param values in nested 'use cache' functions...

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-F2G6-542V-9J58 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

CVE-2026-111446

Wheels versions 4.0.0 through 4.1.2 contain a vulnerability where password-less development tools are exposed under */wheels/ to remote clients when enablePublicComponent=true (the default in development). Prior to version 4.1.2, these tools lacked local-access restrictions; version 4.1.2 introdu...

PYSEC-2026-4215 Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Summary When the HTML backend renders pages in a headless browser HTMLBackendOptionsrenderpage=True, the enablelocalfetch option is not enforced. A crafted HTML file can embed an arbitrary local file for example with , and that file's contents appear in the page image attached to the returned...

CVE-2026-104795 Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution

The insights-runtime-extractor runs as a privileged DaemonSet hostPID: true that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. forks a child process 2. setns into the target container's PID and mount namespaces 3. fchdir back to an orphaned F...

CVE-2026-104795

The insights-runtime-extractor DaemonSet is vulnerable to a container escape due to insufficient privilege dropping during runtime fingerprinting. The coordinator uses seteuid() to switch users, but it fails to change the real UID (ruid) or saved-set-UID , which remain at 0 . Furthermore, the sec...

PT-2026-114078

Name of the Vulnerable Software and Affected Versions pypdftk versions prior to 0.6 Description An OS command injection issue exists in the fill form, dump data fields, and pdftk cmd util functions. The software constructs shell commands using paths provided by the caller. An attacker who can...

CVE-2026-110131

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

CVE-2026-109561

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by updategoosemode. After a session uses Smart Approval mode, prompt-injected calls to...

PT-2026-110143

Name of the Vulnerable Software and Affected Versions GoatCounter versions prior to 2.7.1 Description A mass assignment privilege escalation exists in the userPrefSave handler. This issue allows authenticated users to modify protected account fields using form-encoded requests. An attacker with...

GO-2026-6650 SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernel

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint /ws/network/proxy via explicit CheckOrigin: true bypass in github.com/siyuan-note/siyuan/kernel...