GHSA-X8MG-6R4P-87PF ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

About 14 HTTP handlers resolve the database path param and call getDatabase... WITHOUT user.canAccessToDatabase... and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler which holds the only per-database gate at...

Exploit for Out-of-bounds Read in Google Chrome

CVE-2026-11645 - Chrome V8 Out-of-Bounds Read/Write Exploit...

Exploit for CVE-2026-40003

CVE-2026-40003 aka Joselito is arbitrary memory write vulnerabil...

Exploit for Out-of-bounds Write in Adobe Acrobat

EP284U This project is about CVE-2008-2992. Author | Name...

Exploit for Out-of-bounds Write in Openssl

No d...

Exploit for Out-of-bounds Write in Tp-Link Omada_Sg2005P-Pd_Firmware

Proof-of-concept exploit for CVE-2026-1668 This is a proof-of...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003036)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003036 advisory. In ashmemioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege enabli...

EUVD-2012-2776

Malware in sbrugna...

EUVD-2021-16074

Malware in sbrugna...

EUVD-2018-0272

Malware in sbrugna...

EUVD-2025-6786

Malicious code in bioql PyPI...

EUVD-2023-27782

Malicious code in bioql PyPI...

EUVD-2024-15911

Malicious code in bioql PyPI...

Important: python-setuptools

Issue Overview: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the...

CVE-2025-43026

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write...

CVE-2020-9091

Taurus-AN00B versions earlier than 10.1.0.156C00E155R7P2 have an out-of-bounds read and write vulnerability. Some functions do not verify inputs sufficiently. Attackers can exploit this vulnerability by sending specific request. This could compromise normal service of the affected device...

H2O Vulnerable to Denial of Service (DoS) and File Write

In h2oai/h2o-3 version 3.46.0.1, the runtool command exposes classes in the water.tools package through the ast parser. This includes the XGBoostLibExtractTool class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service...

Unspecified Vulnerability in Siemens InterMesh Subscriber Devices (CNVD-2024-41573)

InterMesh is a wireless alarm reporting system that uses mesh wireless network technology to transmit alarm signals. A security vulnerability exists in Siemens InterMesh Subscriber Devices, which can be exploited by an attacker to write arbitrary files to the web server's DocumentRoot directory...

Oracle Linux 8 : squashfs-tools (ELSA-2024-3139)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-3139 advisory. 4.3-21 - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix CVE-2021-40153 squashfs-tools: unvalidated filepaths...

CVE-2022-26520

In pgjdbc before 42.3.3, an attacker who controls the jdbc URL or properties can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat...