Publicly Disclosed
PoC Exploits

The Fedify TypeScript library, used for building federated server applications powered by ActivityPub, has a critical vulnerability relating to Server-Side Request Forgery. While prior updates attempted to address internal network access by adding public URL validation for outbound fetches, the v...

A vulnerability exists in the Linux kernel's OverlayFS subsystem that enables a local user to gain unauthorized access to a setuid file with capabilities. This issue arises when a user copies a capable file from a nosuid mount to another mount, leading to potential privilege escalation. The uid m...

A bypass and injection vulnerability exists in Apache Camel stemming from a flaw in its default header filtering mechanism. This flaw allows attackers to circumvent protective measures by manipulating the casing of header names. As a result, they can inject malicious headers which may invoke arbi...

A vulnerability in Apache Solr allows for remote unauthorized access due to hardcoded default credentials in the Basic Authentication setup tool. Versions 9.4.0 through 9.10.1 and 10.0.0 are particularly exposed, as attackers can leverage these known credentials to gain full control over the Solr...

The FileBasedKeyLifecycleManager class in Apache Camel allows deserialization of `<keyId>.key` files using java.io.ObjectInputStream without implementing ObjectInputFilter or restricting class loading. This flaw can lead to arbitrary code execution due to unsanitized deserialization methods being...

An integer overflow vulnerability is present in HAProxy versions 2.0 through 2.5. This flaw is associated with the htx_add_header function, enabling attackers to exploit the vulnerability to conduct an HTTP request smuggling attack. By bypassing all configured HTTP request Access Control Lists (A...

A security vulnerability has been identified in Tumf's MCP Text Editor, specifically in the _validate_file_path function found in text_editor.py. This vulnerability allows an attacker to perform path traversal by manipulating the 'file_path' argument, potentially gaining unauthorized access to se...

A security vulnerability has been identified in the Online Food Order System by Code-Projects, specifically in the edit_food_items.php file. This flaw allows for SQL injection through manipulated inputs in the 'update' argument. Attackers can exploit this vulnerability remotely, potentially leadi...

A vulnerability exists in the CodeAstro Simple Online Leave Management System version 1.0, specifically related to inadequate input validation in the /SimpleOnlineLeave/index.php file. By manipulating the 'email' parameter, an attacker may execute SQL injection attacks, potentially accessing sens...

A deserialization flaw exists in davenardella's Snap7 product, impacting the TS7Worker::PerformFunctionRead function within the ReadVar Request Handler component. This vulnerability allows for manipulation of data structures, which can lead to remote exploitation on local networks. The problem ha...

A security issue has been identified in Helm, the package manager for Kubernetes Charts. Versions 4.0.0 through 4.1.3 are impacted by a flaw that allows a specially crafted Helm plugin to write files to arbitrary locations on the filesystem when installed or updated. To mitigate this risk, it is ...

A command injection vulnerability exists in the Apache Camel Docling component due to improper validation of custom CLI arguments. The vulnerability arises when the DoclingProducer constructs an argument list for the external 'docling' command-line tool, where insufficient validation may allow an...

The Composio SDK is affected by a path validation bypass vulnerability that allows malicious actors to read and exfiltrate sensitive files. This issue arises from the missing assertSafeFileUploadPath check in the readFileFromDisk function located in tool-file-uploads.ts. By exploiting prompt inje...

Gradio, an application developed by Gradio App, contains a vulnerability that impacts versions prior to 6.20.0. This security issue involves an open redirect and server-side request forgery that can be exploited by attackers. By manipulating the file_fetch() function in the /gradio_api/file= endp...

The Midscene Bridge Server, up to version 1.10.3, is susceptible to a vulnerability that enables unauthenticated remote attackers to hijack active bridge sessions. This exploit works by opening a cross-origin WebSocket connection to the local Socket.IO server, which fails to validate the Origin h...

The rpcx library, prior to version 1.9.3, is susceptible to a denial-of-service attack due to inadequate controls in the message decoding process. When handling messages with a compression flag, the payload is decompressed without restrictions on size, which can result in significant heap allocat...

A vulnerability in Bitwarden Server prior to version 2026.6.0 allows a low-privileged member of an organization to exploit the authentication request process. By creating a Trusted Device Encryption request using an attacker-controlled public key, the malicious actor can obtain another user's vau...

In Cursor Code Editor versions prior to 1.3, a significant vulnerability exists allowing attackers to execute arbitrary code remotely. This occurs through manipulation of a trusted MCP configuration file either within a shared GitHub repository or on the target machine. If an attacker can alter t...

The OpenSLP service in VMware ESXi contains a heap overflow vulnerability that could allow an attacker within the same network segment to execute arbitrary code. By sending specially crafted packets to port 427, an unauthorized actor may exploit this flaw, potentially compromising the entire syst...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability exists in the Harness platform, specifically within the gitspaces component, affecting versions up to 2.28.2. The issue is located in the getAuthorizedSpaces function of the app/api/controller/gitspace/list_all.go file. It allows unauthorized users to bypass authorization, potenti...

A command injection vulnerability has been identified in the OpenLLM 0.6.30, specifically within the async_run_command function located in src/openllm/common.py. This flaw allows an attacker to manipulate the cmd argument, potentially leading to unauthorized command execution on affected systems....

The Joomla extension Page Builder CK contains a vulnerability that allows unauthenticated attackers to upload arbitrary files. This weakness can be exploited to upload executable files, resulting in remote code execution on the server. The implications of this vulnerability are severe, as it may ...

A vulnerability identified in Flask-MonitoringDashboard, up to version 5.0.2, facilitates cross-site request forgery attacks. This issue allows attackers to exploit certain functions without proper authorization, potentially leading to unauthorized actions performed on behalf of legitimate users....

A memory management vulnerability in the Linux kernel's eventpoll subsystem allows for a misuse of freed memory, resulting from improper handling of file structures during critical operations. The flaw occurs when an ep_remove operation clears a file pointer under lock while allowing concurrent o...

The Appointment Booking Calendar Plugin for WordPress, up to version 1.1.28, fails to validate user input before it is processed by a PHP deserialization function. This flaw exposes the plugin to attacks from unauthenticated users, who could exploit the vulnerability to inject arbitrary PHP objec...

The Frontend File Manager Plugin for WordPress, version 23.6, is susceptible to a vulnerability that allows unauthenticated users to delete arbitrary files on the server without proper validation of file paths derived from user input. This issue is particularly concerning when guest upload mode i...

The vulnerability arises from a logic error in the key-based pairing process of certain Android devices. This flaw may allow an attacker in proximity to exploit the issue and gain unauthorized access to sensitive user information, including conversations and location data. Notably, the attack doe...

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

An SQL injection vulnerability exists in specific versions of Django prior to 5.1.14, 4.2.26, and 5.2.8. Through the use of specially crafted dictionaries, attackers can exploit the `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()` methods, as well as the `Q()` class, when utilizing...

The OAuth implementation in phpBB has a critical flaw where improper authentication checks can lead to account hijacking. This vulnerability is particularly concerning as it may allow unauthorized users to gain access to accounts even if OAuth is not configured or enabled. Default installations a...

A use after free vulnerability in the CSS handling of Google Chrome versions prior to 147.0.7727.101 enables remote attackers to execute arbitrary code. This vulnerability can be triggered through a maliciously crafted HTML document, allowing unauthorized actions within a sandboxed environment, w...

A vulnerability has been identified in Hyland Perceptive Filters versions prior to December 8, 2023. This issue affects products like Cisco IronPort Email Security Appliance Software and Cisco Secure Email Gateway, along with several non-Cisco products. Attackers can exploit this flaw by crafting...

A vulnerability exists in the command-line interface (CLI) of Cisco Secure Email Gateway due to improper input validation. This security flaw allows authenticated, remote attackers to inject malicious operating system commands into legitimate commands. A successful exploitation of this vulnerabil...

A vulnerability exists within the Web UI and administrative CLI of Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA). This security flaw enables both authenticated local and remote attackers to escalate their privileges, potentially gaining root access on the device. T...

The webservices in Proofpoint Enterprise Protection (PPS/POD) are susceptible to a vulnerability that enables unauthorized users to execute remote code through 'eval injection'. Exploitation of this vulnerability necessitates network access to the webservices API; however, such access is typicall...

The webutils component of Proofpoint Enterprise Protection is affected by a vulnerability that permits an authenticated user to leverage eval injection for remote code execution. This vulnerability affects all versions up to and including 8.20.0, potentially allowing malicious actions by users wi...

A significant SQL injection vulnerability has been identified in the Hotel and Tourism Reservation application by Code-Projects, specifically within the Room Management Page component. The vulnerability arises from the manipulation of an argument within the /admin/rooms.php file, allowing an atta...

Cognee, prior to version 1.2.0, exhibits an improper access control vulnerability that allows unauthenticated attackers to register an account and modify global LLM provider configurations through the settings endpoint. This endpoint does not enforce necessary administrative checks, enabling atta...

The FluxInk Color Management Driver (TcnPeripheral64.sys) version 1.0.7.2 contains a security flaw that allows a standard user account to escalate privileges by mapping arbitrary physical memory. This vulnerability poses a significant risk, enabling unauthorized users to gain elevated access and ...

NocoBase, up to version 2.1.20, exhibits a server-side request forgery vulnerability within the serverRequest wrapper. This flaw permits authenticated administrators to make unauthorized outbound HTTP requests by inputting malicious URL links into workflow request nodes, custom action buttons, or...

A vulnerability has been identified in the Linux kernel concerning the KVM x86 module, specifically a use-after-free scenario due to an unexpected role in shadow paging. This issue arises when a host modifies a Page Directory Entry (PDE) mapping from outside a guest virtual machine and subsequent...

A vulnerability exists within the RAR5 recovery-volume parser used in WinRAR and UnRAR, leading to potential heap corruption through crafted .rev files. This flaw stems from the incorrect validation of input that allows for manipulation of internal data structures, posing a risk when users perfor...

GeoServer, an open-source server enabling geospatial data sharing and manipulation, contains a vulnerability that permits unauthenticated users to execute arbitrary code. This flaw arises from the handling of OGC request parameters, where property names are unsafely evaluated as XPath expressions...

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default config...

The web server binary '/bin/httpd' contains a vulnerability that enables a hidden backdoor authentication mechanism within its login function. This flaw allows unauthorized access by reading a backdoor password from the device configuration file if normal authentication fails. Using a direct comp...

A vulnerability has been identified in the Linux kernel concerning the KVM x86 module, specifically a use-after-free scenario due to an unexpected role in shadow paging. This issue arises when a host modifies a Page Directory Entry (PDE) mapping from outside a guest virtual machine and subsequent...

Vtiger CRM versions prior to 8.4.0 are subject to an authenticated file upload vulnerability that allows low-privileged users to perform remote code execution. This is achieved by uploading a .phar file containing malicious PHP code through the Documents module, circumventing the configured denyl...

Vtiger CRM versions up to 8.4.0 contain a vulnerability that permits authenticated users with administrative privileges to execute arbitrary PHP code remotely. This occurs via the ModuleManager's import feature, which allows crafted zip files to be uploaded without sufficient validation. Attacker...

The MSI Feature Manager, through its KernCoreLib64.sys kernel driver, introduces a local privilege escalation vulnerability. This flaw enables any locally authenticated user to execute arbitrary read/write operations on physical memory and conduct unrestricted I/O port operations. By exploiting e...