Publicly Disclosed
PoC Exploits

A vulnerability has been identified in OpenTelemetry-Go versions 1.15.0 to 1.42.0, where the BSD kenv command is susceptible to PATH hijacking. The fix for a related issue altered the Darwin ioreg command to utilize an absolute path, yet overlooked the BSD kenv command, which remains vulnerable. ...

A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in Pardus MyComputer developed by TÜBİTAK BİLGEM, potentially allowing unauthorized access and manipulation of system states. This issue impacts versions from 0.8.0 to prior 0.8.1, where the timing discrepancies between veri...

An OS Command Injection vulnerability exists within the Pardus Boot Repair software developed by TÜBİTAK BİLGEM. This flaw allows an attacker to manipulate OS commands executed by the system, potentially leading to unauthorized command execution. The issue specifically affects versions of Pardus ...

The Tabularis SQL injection vulnerability in versions prior to 0.28.0 allows attackers to exploit its SQLite driver. By crafting a malicious `table_name` when using the `describe_table` feature, an attacker can manipulate the PRAGMA command to execute stacked SQL statements. This could lead to un...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

GeoNode, a geospatial content management system, is exposed to a shell command injection vulnerability. This issue arises when a low-privileged remote user uploads a specially crafted vector file layer name. The injected shell syntax can be used to execute arbitrary operating-system commands on t...

JumpServer, an open-source bastion host and operation maintenance security audit system, has a security flaw in its Applet and VirtualApp upload functionalities. This issue allows users with administrative privileges to exploit the application through a Server-Side Template Injection (SSTI). The ...

The fsspec library, utilized for filesystem interfaces in Python, contains a flaw that allows remote code execution via specially crafted Kerchunk reference JSON documents. This vulnerability affects versions from 0.9.0 to 2026.6.0. By leveraging unrestricted template rendering, malicious users c...

The Stanza library, a powerful NLP tool developed by Stanford, is exposed to an arbitrary code execution vulnerability. This flaw arises from the way the library handles lemmatizer checkpoints. Specifically, in versions prior to 1.15.0, an attacker could supply a malicious lemmatizer checkpoint, ...

In HTTPX2, a next-generation HTTP client for Python, there exists a flaw in the Request._prepare() method found in src/httpx2/httpx2/_models.py. Before version 2.11.0, it is possible for the method to improperly add a Content-Length header that is derived from the request body while simultaneousl...

An authentication bypass vulnerability exists in LACT due to improper handling of UnixProcessSubject and Peer PID, which could allow unauthorized users to gain access to functionalities restricted to privileged accounts. This issue affects all versions of LACT up to 0.10.0. A patch has been imple...

A vulnerability has been identified in Pingora's handling of HTTP/1.0 request bodies and Transfer-Encoding values, which can lead to HTTP Request Smuggling attacks. This issue allows malicious actors to craft specially formatted requests that desynchronize Pingora’s request processing from backen...

The Open WebUI platform is vulnerable to a path traversal issue due to insufficient input validation in the terminal-server reverse proxy. This vulnerability allows an authenticated user to manipulate the `path` parameter, potentially leading to unauthorized access to sensitive files and endpoint...

A vulnerability has been discovered within the web-based management interface of AOS-CX switches by HPE. This issue could allow unauthorized actors to bypass existing authentication measures, potentially leading to unauthorized remote access. In certain scenarios, this vulnerability may also faci...

The git-diff tool prior to version 2.0.7 has a vulnerability that allows malicious users to inject shell commands. This is achieved by supplying specially crafted strings to the gitDiff API, enabling attackers to execute arbitrary commands with Node.js process privileges. Users leveraging diffed ...

The Nuxt framework prior to version 4.6.3 contains a vulnerability related to path manipulation, where it resolves literal or percent-encoded dot segments before rendering a page. This issue can allow for the unintended rendering of pages, such as /admin, despite server checks being designed to p...

OAuthLib, an OAuth implementation for Python, has a vulnerability in its token grant handling mechanism. Specifically, prior to version 4.0.0, it allows the client_credentials and Resource Owner Password Credentials grant handlers to incorrectly authenticate a request.client as a confidential cli...

ZITADEL versions 3.4.15 and earlier in the 3.x series, along with all 4.x versions prior to 4.19.2, are susceptible to an authentication bypass due to a flaw in the SAML identity provider's intent callback mechanism. This vulnerability occurs when the assertion signature verification process inco...

A security flaw has been identified in Turboderp-org's ExLlamaV3 software, specifically affecting versions up to 1.6.3. The vulnerability resides in the ngram_dequant function located in the ngram.cu file within the NGramEmbedding component. When the head_bias argument is manipulated, it can lead...

The filelock library, which provides a platform-independent file locking mechanism for Python, has a vulnerability present in versions 3.20.4 through 4.0.8. Specifically, the ReadWriteLock and AsyncReadWriteLock components resolve the lock path and pass it to SQLite without adequately rejecting t...

Argo CD, a continuous delivery tool for Kubernetes, is susceptible to command injection when handling SSH Git repositories with a proxy URL. This issue arises in versions from 2.11.0 to specific releases in the 3.x series, allowing users with the ability to create or modify repository configurati...

Pillow, a widely used Python imaging library, is susceptible to an argument injection vulnerability found in its EpsImagePlugin when utilizing Ghostscript for EPS inputs. This flaw arises from the inadequate sanitization of caller-controlled input filenames, which can lead to the execution of arb...

Replicate Cog version 0.23.1 is susceptible to a server-side request forgery vulnerability, enabling attackers to manipulate the Cog process into executing unauthorized server-side HTTP requests. By injecting malicious URLs in the prediction inputs of the cog.File and cog.Path predictors, attacke...

The shell-quote library's `quote()` function poses a security risk by improperly handling comment tokens within command strings. Specifically, when a `{ comment }` token is included, it generates a line starting with `#`, which comments out subsequent input that follows it, including the opening ...

The Solspace Freeform plugin for Craft CMS versions 5.0.0 to 5.10.13 contains a vulnerability that allows an unauthenticated attacker to inject Twig expressions into submitted form fields. When these expressions are evaluated in the isolated Twig renderer, they can potentially reveal sensitive se...

The LZ4 Java implementation by Yawkat, versions 1.7.0 to 1.11.4, contains a vulnerability in the loading mechanism of native libraries. The issue lies in the way temporary .lck files are created using File.createTempFile. A potential attacker can exploit this flaw by creating or replacing the lib...

The vulnerability in Seroval arises from a flaw that allows for improper handling of untrusted input during the JavaScript value stringification process. Before version 1.6.8, the fromJSON method could reconstruct an AsyncIteratorFactoryInstance without validating the source, potentially allowing...

Versions of NLTK prior to 3.10.3 include a significant remote code execution vulnerability that arises from their handling of allowlisted pickle loaders. These loaders trust entire module namespaces instead of restricting access to specific safe callables. This flaw allows attackers to craft mali...

A flaw has been identified in Keycloak that allows attackers with valid client credentials to exploit a weakness in the JWT Authorization Grant flow. This vulnerability permits an attacker to bypass signature verification and forge access tokens. Consequently, the attacker can impersonate any fed...

The fast-jwt library, which provides a fast implementation of JSON Web Tokens (JWT), contains a vulnerability that allows an attacker to bypass authentication or authorization checks. Prior to version 6.3.1, the createVerifier function in fast-jwt can erroneously accept an unsigned JWT when the k...

MLflow, the open-source AI engineering platform, contains a flaw in its webhook validation process. The issue resides in the POST /api/2.0/mlflow/webhooks/{id}/test endpoint, which neglects to fully validate URLs when processing redirects. This oversight can permit attackers to access internal or...

The PhpSpreadsheet library has a vulnerability in the Worksheet\Drawing::setPath method that improperly validates external image URLs when external image loading is allowed. This weakness can be exploited through HTTP redirects that lead to internal addresses, allowing unauthorized access to inte...

The Jupyter nbconvert tool, utilized for converting Jupyter notebooks into various formats, is susceptible to a path traversal vulnerability. This flaw affects versions from 5.4.0 to 7.17.2, where the ExtractOutputPreprocessor does not adequately restrict the file output directory. By exploiting ...

The Echo framework by Labstack has an encoding vulnerability that emerges from a conflict in handling encoded request paths. Versions prior to 4.16.0 and 5.4.0 possess global middleware.Static instances that interpret encoded paths inconsistently. While the Echo router continues to match the enco...

Certain versions of Traefik are susceptible to an authentication bypass due to a path traversal vulnerability in the ReplacePathRegex middleware. This issue arises when the middleware is configured with a regex that captures user-controlled segments without a mandatory path separator. An attacker...

Vikunja, an open-source self-hosted task management platform, has a security issue where enabling the per-provider 'emailfallback' option on OpenID Connect providers allows an attacker to bypass authentication. The vulnerability arises because the platform only verifies the 'email' claim from the...

Authlib versions 1.7.2 and earlier have a vulnerability in the JsonWebSignature.deserialize_json() method, which improperly validates signatures. This flaw allows for the potential bypass of signature checks, as it accepts a JSON Serialization JWS object and returns the payload as verified, witho...

An out of bounds read vulnerability exists in the decodeWapPdu function of the WapPushOverSms.java file within the Android operating system. This issue arises due to an integer overflow, which can lead to a remote denial of service. Attackers can exploit this vulnerability without requiring user ...

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli li...

A heap-based buffer overflow vulnerability in the xmlStrncat function in libxml2 versions prior to 2.9.4 allows attackers to exploit weakly validated XML documents. This vulnerability enables remote actors to execute arbitrary code or instigate a denial of service through crafted XML input, impac...

The Gitea Runner software has a significant vulnerability that allows workflow authors to manipulate container options for Docker jobs, even when running in a non-privileged mode. This flaw enables unauthorized access to host namespaces and the execution of commands with root privileges on the ru...

A heap buffer overflow vulnerability has been identified in Google Chrome and libwebp, which could allow remote attackers to perform out-of-bounds memory writes. This security issue arises when specially crafted HTML pages are processed, potentially leading to significant impacts on the affected ...

A type confusion vulnerability has been identified in OpenSSL that affects how X.400 addresses are processed within an X.509 GeneralName. This issue arises due to an incorrect specification of the x400Address field type, leading to improper interpretation by the function GENERAL_NAME_cmp. When Ce...

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size r...

Webmin 2.670 is affected by a stored cross-site scripting (XSS) vulnerability in its Shorewall and Shorewall6 modules. This flaw occurs due to a lack of proper escaping for table fields and COMMENT lines in the list.cgi script. Authenticated users with permissions to edit these tables can store h...

An identified vulnerability in the Windows TCP/IP stack permits an unauthorized attacker to execute arbitrary code on vulnerable systems. By sending specially crafted packets, an assailant can gain control over the affected system, enabling potential unauthorized access, data theft, or further sy...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A Path Traversal vulnerability has been identified in TÜBİTAK's pardus-boot-repair, enabling unauthorized access to restricted directories. This vulnerability impacts versions 1.0.8 and prior to 1.1.0, potentially allowing attackers to manipulate file paths and access sensitive information on the...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...