mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 12:38:17 -10:00
Update Thu Jul 23 11:52:27 UTC 2026
This commit is contained in:
trickest-workflows committed
1 parent
ed228d55b7
commit
efd7fc7269
148 files changed
+2492
-6
No files matched your search
@@ -11,6 +11,7 @@ On certain Samsung P(9.0) phones, an attacker with physical access can start a T
|
||||
|
||||
#### Reference
|
||||
- https://security.samsungmobile.com/securityUpdate.smsb
|
||||
- https://twitter.com/fs0c131y/status/1115889065285562368
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19
|
||||
|
||||
#### Reference
|
||||
- http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html
|
||||
- https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Authenticated stored cross-site scripting (XSS) in the contact name field in the
|
||||
|
||||
#### Reference
|
||||
- http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html
|
||||
- https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN/
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cvemon
|
||||
|
||||
@@ -10,7 +10,7 @@ An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webm
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cvemon
|
||||
|
||||
@@ -10,7 +10,7 @@ An issue was discovered in MDaemon before 20.0.4. Remote Administration allows a
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/
|
||||
|
||||
#### Github
|
||||
- https://github.com/chudyPB/MDaemon-Advisories
|
||||
|
||||
@@ -10,7 +10,7 @@ An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection v
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/
|
||||
|
||||
#### Github
|
||||
- https://github.com/chudyPB/MDaemon-Advisories
|
||||
|
||||
@@ -10,7 +10,7 @@ An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/
|
||||
|
||||
#### Github
|
||||
- https://github.com/chudyPB/MDaemon-Advisories
|
||||
|
||||
@@ -11,6 +11,7 @@ Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have all
|
||||
|
||||
#### Reference
|
||||
- https://media.dedaub.com/uniswap-bug-bounty-1625d8ff04ae
|
||||
- https://twitter.com/dedaub/status/1610058814094450694
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,11 +1,17 @@
|
||||
### [CVE-2023-3390](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3390)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.
|
||||
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -6,6 +6,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -12,6 +12,7 @@ An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 a
|
||||
#### Reference
|
||||
- https://github.com/ZeroMemoryEx/CVE-2025-26125
|
||||
- https://github.com/ZeroMemoryEx/IObit-EoP
|
||||
- https://x.com/zeromemoryex/status/1876878269200449819
|
||||
|
||||
#### Github
|
||||
- https://github.com/0xMarcio/cve
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-30417](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30417)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
There is a memory corruption vulnerability due to an out of bounds write in Library!DecodeBase64() when using the SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-30418](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30418)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
There is a memory corruption vulnerability due to an out of bounds write in CheckPins() when using the SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-30419](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30419)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
There is a memory corruption vulnerability due to an out of bounds read in GetSymbolBorderRectSize() when using the SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-30420](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30420)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
There is a memory corruption vulnerability due to an out of bounds read in Bitmap::InternalDraw() when using the SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-30421](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30421)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
There is a memory corruption vulnerability due to a stack-based buffer overflow in DrObjectStorage::XML_Serialize() when using the SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11001](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11001)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/493691489
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11018](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11018)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/497342466
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11049](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11049)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/498815068
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11075](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11075)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Out of bounds read in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/499659070
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11105)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/500505339
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11140](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11140)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/501659253
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11144](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11144)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/501676175
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11166](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11166)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/502118936
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11167](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11167)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/502228856
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11179](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11179)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Inappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/502615170
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11232](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11232)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/495981782
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11239)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/497025738
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11252](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11252)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/498373018
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-12082](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12082)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d23cb7bd-b40c-4f87-a134-7c3b62043f18/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14291](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14291)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e62cfba9-4956-43ba-8554-6cdb0eb8815b/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16624)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://vokecyber.com/research/calcom-cross-tenant-webhook-plant
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-31069](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31069)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/nedlir/2377ba6e7fa2ad957210b52aa8e400d9
|
||||
- https://gist.github.com/nedlir/a50725b94650467f0593b8f4009ae19e
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-31309](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31309)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sch8ill/CVE-2026-31309
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-38763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-38763)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via the function sub_13828
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://dreadsec.co/p/protogent-kernel-anti-virus-multiple-vulnerabilities.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-38765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-38765)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://dreadsec.co/p/protogent-kernel-anti-virus-multiple-vulnerabilities.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-38766](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-38766)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_186f4 function
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://dreadsec.co/p/protogent-kernel-anti-virus-multiple-vulnerabilities.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-42035](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42035)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-42040](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42040)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and 0.31.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-42041](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42041)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-42042](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42042)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42049](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42049)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groovy code on the victim machine. This issue is fixed in version 1.5.6.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/skylot/jadx/security/advisories/GHSA-w6f5-h4x4-rfpj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42086](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42086)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage. This issue has been patched in version 7.0.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42091](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42091)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler (httpserver/server.go), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network). This issue has been patched in version 2.0.2.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42138](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42138)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This issue has been patched in version 1.13.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/langgenius/dify/security/advisories/GHSA-cg94-8v83-7hjj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42148](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42148)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without shell escaping, allowing an attacker who can set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This issue is fixed in version 4.0.0-beta.474.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/coollabsio/coolify/security/advisories/GHSA-x9qh-w4c4-54f9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42177)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonline.com/*". Chrome's urlFilter without a | or || anchor is substring-matched against the full request URL. The same applied rule action is modifyHeaders that attaches the Entra ID Primary Refresh Token cookie. The Firefox adapter in platform/firefox/js/platform-firefox.js:53 performs a belt-and-braces startsWith(Platform.SSO_URL) check before injecting the header; the Chrome adapter does not. When the extension holds broad host permissions through the optional_host_permissions: ["https://*/*"] declared in platform/chrome/manifest.json:34, a main-frame navigation to a URL whose path embeds https://login.microsoftonline.com/ causes Chrome to attach the PRT cookie to the request to the attacker-controlled host. This vulnerability is fixed in 1.8.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/siemens/linux-entra-sso/security/advisories/GHSA-52rj-42vh-2rxc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42181](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42181)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42185](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42185)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/suitenumerique/people/security/advisories/GHSA-42cf-rv2h-v8rf
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42194)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Admidio/admidio/security/advisories/GHSA-hcjj-chvw-fmw9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42199](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42199)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42200](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42200)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution through database initialization. This issue is fixed in version 4.0.0-beta.474.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/coollabsio/coolify/security/advisories/GHSA-mv4c-9x67-rrmv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42201](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42201)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/coollabsio/coolify/security/advisories/GHSA-f35h-g2c2-q36v
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42209)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. This issue has been patched in version 1.26.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/halfgaar/FlashMQ/issues/167
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42214](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42214)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42239)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT session token is set with httpOnly: false at packages/backend-core/src/utils/utils.ts:218. JavaScript can read this cookie via document.cookie. This means every XSS becomes a full account takeover — the attacker steals the JWT and has persistent access to the victim's account. The cookie also lacks secure: true (sent over plaintext HTTP) and sameSite attribute. This issue has been patched in version 3.35.10.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Budibase/budibase/security/advisories/GHSA-4f9j-vr4p-642r
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-42261](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42261)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts exposes an authenticated endpoint POST /api/skills/fetch-remote that fetches a user-supplied URL server-side and reflects the response body (up to 5 MB) back to the caller. The SSRF protection in apps/web/src/utils/remote-http.ts (isPrivateIPv6) attempts to block private/loopback destinations, but multiple alternate-but-valid IPv6 representations bypass the check. The bypasses reach any IPv4 address (loopback, RFC1918, link-local) via IPv4-mapped IPv6 in hex form, and the canonical ::1 via any representation that isn't the literal string "::1". Any authenticated user (role: user or admin) can trigger the SSRF. On deployments configured with ALLOW_REGISTRATION=true — a supported and documented configuration — this means any internet user who can register. This issue has been patched in version 0.5.4.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/legeling/PromptHub/security/advisories/GHSA-9fhh-fjfg-5mr6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42278](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42278)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contains a critical logic flaw in its policy enforcement pipeline. When a transaction originates from a "Pocket" (a derived sub-address documented in the protocol as a way to organize funds), the engine fails to resolve the pocket's parent account before checking the spending policy. Because pockets are "virtual" addresses that exist only as entries in the pocket_to_parent map and do not have their own SmartAccountConfig entries, the check_spending_policy method defaults to an "authorized/no policy" result. This allow any user (or attacker in possession of a parent key) to instantly drain every pocket on an account, even if the parent account has a strict 24-hour vault delay or a 1 UDAG daily limit. This issue has been patched via commit fb6ef59.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/UltraDAGcom/core/security/advisories/GHSA-9chc-gjfr-6hrq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42295](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42295)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-7vf8-2cr6-54mf
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-42313](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42313)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy", "username") and ("proxy", "password") — which protect the proxy credentials — but it does not include ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), or ("proxy", "type"). Any authenticated user with the non-admin SETTINGS permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pyload/pyload/security/advisories/GHSA-pg67-9wjv-mr85
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42314](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42314)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement (partial removal), leaving .. which can be exploited when the path is later resolved by the OS. This vulnerability is fixed in 0.5.0b3.dev100.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pyload/pyload/security/advisories/GHSA-97r3-5w84-r4q8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42315)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary directories as download locations for a package. This vulnerability is fixed in 0.5.0b3.dev100.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pyload/pyload/security/advisories/GHSA-838g-gr43-qqg9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42343](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42343)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42345](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42345)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith() check against a hardcoded list. This check can be bypassed using at least 7 different URL encoding techniques, all of which resolve to the same cloud metadata service but do not match the blocklist patterns. Additionally, the broader private IP check (isInternalIPv4/isInternalIPv6) is disabled by default because CHECK_INTERNAL_IP defaults to false (not 'true'), so these bypasses reach the metadata endpoint without any further validation. At time of publication, there are no publicly available patches.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/labring/FastGPT/security/advisories/GHSA-jhqw-944x-xh94
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42442](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42442)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR (directory). The parser unconditionally treats the root inode as a directory without checking its type, and when the symlink has an embedded target (small di_size), the directory data buffer is zero-length, causing a null-pointer dereference on the first read. This vulnerability is fixed in 6.0.1698.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/M2Team/NanaZip/security/advisories/GHSA-8r4x-fx3w-ph77
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42446](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42446)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the file header drives an unbounded loop that reads past the end of a stack-allocated ZEALFS_V1_HEADER structure. This vulnerability is fixed in 6.0.1698.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/M2Team/NanaZip/security/advisories/GHSA-4c79-hfr4-mqv9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42451](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42451)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in Grimmory's browser-based EPUB reader allows an attacker to embed arbitrary JavaScript in a crafted EPUB file. When a victim opens the book, the script executes in their browser with full access to the Grimmory application's session context. This can enable session token theft and account takeover, including administrative access if an administrator opens the affected book. This issue has been patched in version 2.3.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/grimmory-tools/grimmory/security/advisories/GHSA-frv6-5wq5-9p24
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42452](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42452)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_token) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-vx59-rf9w-9jv8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ IRIS is a web collaborative platform that helps incident responders share techni
|
||||
|
||||
#### Reference
|
||||
- http://www.openwall.com/lists/oss-security/2026/05/19/11
|
||||
- https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m73w-v4r5-vw9m
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42545)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42552)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42554](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42554)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph "safe, format-agnostic reply." This vulnerability is fixed in 2.52.12 and 3.1.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-42580](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42580)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-42585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42585)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42592](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42592)
|
||||
|
||||
|
||||
%20Race%20Condition&color=brightgreen)
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only the error. It discards the resolved addresses. Chromium later performs its own DNS resolution when it navigates to the URL. An attacker who controls DNS for a hostname with a short TTL returns a public IP on the first query (Gotenberg allows) and a private IP on the second query (Chromium connects to the attacker-chosen internal address). The CDP Fetch.requestPaused handler re-checks the URL but runs its own DNS resolution, leaving a timing window before Chromium's actual TCP connect. The rendered internal service response returns to the caller as a PDF. This vulnerability is fixed in 8.32.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2pmr-289p-44r3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-42602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42602)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42610](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42610)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt. This vulnerability is fixed in 2.0.0-beta.2.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/getgrav/grav/security/advisories/GHSA-3f29-pqwf-v4j4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-42842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42842)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42844](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42844)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42846](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42846)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-hvfx-hxmr-28c7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-42857](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42857)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42870](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42870)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoint: funcionario/profile_funcionario.php?id_funcionario=2. By injecting a malicious payload into the 'Description' (Descrição) field and saving the profile, the script becomes persistently stored. The payload is subsequently executed whenever the profile page is accessed. This vulnerability is fixed in 3.7.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-q6jg-hfqv-882f
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42878](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42878)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vrxf-vrc4-22p7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42883](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42883)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/download endpoint validates that the requesting user has access to the library specified in the URL path, but fetches downloadable items solely by attacker-provided IDs without constraining them to that library. An authenticated user with download permission and access to any one library can exfiltrate the full file contents of items belonging to any other library, including libraries they are explicitly denied access to. This vulnerability is fixed in 2.32.2.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-6rvg-w3f5-9gq5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42885](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42885)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-rhjg-p6cm-38w2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-43946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43946)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/frangoteam/FUXA/security/advisories/GHSA-fwcm-rqvw-j3p7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-43977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43977)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner's private workout history, not the attacker's. This issue has been fixed in version 2.6.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/wger-project/wger/security/advisories/GHSA-cj9g-27ph-4cgv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-46403](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46403)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef
|
||||
- https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52101](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52101)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/nk7667/-linx-server-vulnerability-report/blob/main/CVE-2026-52101.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52186](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52186)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/blob/main/518G/FUN_00463bbc/README.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52187](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52187)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_483ba0 component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/blob/main/518G/FUN_00483ba0/README.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52188](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52188)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead//sub_497498 component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/tree/main/518G/FUN_00497498
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52189](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52189)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_487330 component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/blob/main/518G/FUN_00487330/README.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52190](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52190)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_448384 component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/tree/main/518G/FUN_00448384
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52191](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52191)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_444C8C component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/tree/main/518G/FUN_00444c8c
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52195)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_472f08 component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/tree/main/518G/FUN_00472f08
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52198](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52198)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_425994 component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/blob/main/518G/FUN_00425994/README.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52199](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52199)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lamaper/CVE-2026-52199
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-52200](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52200)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lamaper/CVE-2026-52200
|
||||
- https://github.com/lamaper/UZ801-MifiService-Broken-Access-Control
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
Loaded 100 of 148 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user