1Panel SQL Injection - Authenticated

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to...

SockTail

SockTail SockTail 은 장치를 Tailscale 네트워크에 연결하고 1080 포트에서 로컬 SOCKS5 프록시를 노출하는 작은 바이너리입니다. 지저분한 포트 포워딩, 상주 데몬, 혹은 시끄러운 터널을 설정하지 않고 대상 시스템에 네트워크 액세스가 필요한 레드 팀 운영을 위해 설계되었습니다. 기능 Tailscale을 통한 1080 포트의 SOCKS5 프록시 IPv4, IPv6, 도메인 주소 지원 tsnet을 통한 Tailscale 연결, 외부 의존성 없음 인증 키는 하드코딩하거나정적 분석 회피를 위한 XOR 난독화...

slater

Slater 현재 버전:v0.25.2 — 모든 릴리스. 한 줄 요약: Slater는 메모리에 맞지 않는 그래프 — 수억 개의 노드와 수십억 개의 엣지를 수백 MB 남짓의 RAM으로 — 표준 Bolt 프로토콜로 서비스하므로 어떤 neo4j 드라이버든 그대로 동작하며, 그래프 옆에는 디스크 기반 벡터 검색이 자리 잡고, 이 모든 것을 포기하지 않으면서 실시간 내구성 있는 쓰기 를 처리합니다. 상주 메모리는 그래프 크기가 아니라 사용자가 선택한 캐시 예산 에 의해 결정됩니다. 바로가기 | | | ---|---|---|---...

EUVD-2026-95327

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map...

CVE-2026-84230

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map...

CVE-2026-84275

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector...

CVE-2025-52099

CVE-2025-52099 SQLite 3.50.0의 정수 오버플로우 SQLite 3.50.0의 setupLookaside 함수에서 정수 오버플로우를 트리거하는 개념 증명PoC 코드가 아래에 제공됩니다. 이 오버플로우는 sz nBig의 검사되지 않은 곱셈으로 인해 발생하며, 이 값이 음수로 감싸져 잘못된 메모리 쓰기를 초래할 수 있습니다. 테스트 환경: Ubuntu 22.04 x8664, SQLite 3.50.0직접 빌드 PoC 코드C: include include int main sqlite3 db; // Open SQLit...

EUVD-2026-95078

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-85490

Brocade ASCG versions prior to 3.5.0 are vulnerable to an arbitrary file write via a path traversal flaw. The application fails to sanitize path traversal sequences within support bundle archives ingested from remote compromised endpoints before extraction. An unauthenticated remote attacker who ...

CVE-2026-5049

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

PT-2026-108182

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An unauthenticated attacker can exploit a path traversal issue within the GIM file-upload functionality to write arbitrary files to the Collector. Path traversal is a technique that allows ...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-4010)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...

CVE-2026-41958

A flaw was found in VisiData. This path traversal vulnerability allows a remote attacker to perform arbitrary file writes on the host system. By convincing a user to process a specially crafted URL pointing to a malicious ZIP archive, an attacker can extract files outside the intended destination...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430

The Gitea platform is vulnerable to a Server-Side Request Forgery (SSRF) and forced write vulnerability due to insufficient validation of push mirror remote addresses. The system only validates these addresses against [migrations] allow and block lists during the initial mirror creation. Because ...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

UBUNTU-CVE-2026-98199

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling the source of the output voltage. Note...

PT-2026-106803

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create...

Linux Distros Unpatched Vulnerability : CVE-2026-98199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus/core increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, a...