CVE-2019-16278

CVE-2019-16278 💻 -h3x0v3rl0rd- nostromo 1.9.6 - Remote Code Execution...

CVE-2019-16278-Nostromo_1.9.6-RCE

CVE-2019-16278 - Nostromo 1.9.6 RCE Python script to exploit RCE in Nostromo nhttpd = 1.9.6. Help root@kitploit: usage: CVE-2019-16278.py -h -t TARGET -p PORT -c COMMAND -b BYTES Exploit for CVE-2019-16278 - Nostromo 1.9.6 RCE optional arguments: -h, --help show this help message and exit -t...

CVE-2019-16278-Nostromo-1.9.6-RCE

CVE-2019-16278-Nostromo-1.9.6-RCE This repository contains an exploit for CVE-2019-16278 in Nostromo Web Server 1.9.6, allowing remote code execution via a directory traversal vulnerability. The script uses pwntools to establish a reverse shell. For educational and authorized testing use only...

Fedora 45 : libgit2_1.9 / rust-libgit2-sys (2026-7c3fc14617)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7c3fc14617 advisory. - Update libgit2 to version 1.9.6. - Update the libgit2-sys Rust crate to the corresponding version 0.18.7. This includes fixes for various security...

PT-2026-62029

Name of the Vulnerable Software and Affected Versions libgit2 versions prior to 1.9.6-1.1 Description Security issues were identified and subsequently fixed in the libgit2 package. Recommendations Update to version 1.9.6-1.1...

PT-2026-62018

These are all security issues fixed in the libgit2-1 9-1.9.6-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11315-1 libgit2-1_9-1.9.6-1.1 on GA media

These are all security issues fixed in the libgit2-19-1.9.6-1.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2026-40021

A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6. This vulnerability affects unknown code of the file src/main/services/mcp/oauth/callback.ts of the component MCP OAuth Local Callback Server. The manipulation of the argument code leads to improper authorization. Th...

CVE-2025-31013

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6...

CVE-2026-7083

CVE-2026-7083 affects likeadmin-likeshop likeadmin_php up to 1.9.6. The vulnerability is in the function queryResult of server\app\adminapi\lists\tools\DataTableLists.php within the DataTable Admin API. This manipulation leads to a SQL injection vulnerability that can be exploited remotely. The e...

PT-2026-35349

Name of the Vulnerable Software and Affected Versions likeadmin-likeshop likeadmin php versions prior to 1.9.7 Description A remote SQL injection exists in the dataTable Admin API component. The issue is located in the queryResult function within the serverappadminapiliststoolsDataTableLists.php...

EUVD-2026-19295

Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution...

CVE-2026-34148 Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or...

EUVD-2026-17294

SciTokens has an Authorization Bypass via Incorrect Scope Path Prefix Checking...

EUVD-2026-17293

SciTokens is vulnerable to SQL Injection in KeyCache...

PYSEC-2026-2276

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match startswith. This allows a token with access to a specific path e.g., /john to also access sibling paths that start with the sa...

PYSEC-2026-2276

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match startswith. This allows a token with access to a specific path e.g., /john to also access sibling paths that start with the sa...

CVE-2026-32716

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match startswith. This allows a token with access to a specific path e.g., /john to also access sibling paths that start with the sa...

CVE-2026-32714

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format to construct SQL queries with user-supplied data such as issuer and keyid. This allowed an attacker to...

CVE-2026-32716

Summary: SciTokens Enforcer prior to 1.9.6 validates scope paths with a simple prefix match, allowing a token for a path like /john to access sibling paths (/johnathan, /johnny), causing an Authorization Bypass. Affecting: SciTokens library (pre-1.9.6). Root cause: incorrect scope path validation...