Publicly Disclosed
PoC Exploits

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

This vulnerability allows remote attackers to perform a stored cross-site scripting (XSS) attack by exploiting unauthenticated updates to public UI settings in the Rancher interface. It affects multiple versions of SUSE Rancher, enabling potential unauthorized access and manipulation of sensitive...

The com.epson.InstallNavi.helper tool, part of the EPSON printer driver installer, is susceptible to a local privilege escalation issue due to multiple implementation flaws. The tool inadequately authenticates clients via the XPC protocol, failing to uphold the authorization model in macOS. This ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The Linux kernel has a vulnerability in the SMB client, which can cause a heap overflow during the rewriting of discretionary access control lists (DACLs). This occurs when the size of SID (Security Identifier) replacement exceeds the allocated buffer size, particularly when transitioning from sh...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A path traversal vulnerability exists in Fortinet's FortiMail products, affecting multiple versions. This issue allows unauthenticated attackers to craft HTTP or HTTPS requests that can lead to unauthorized file writing on the underlying system. Implementing proper access controls and promptly ap...

A vulnerability in GitLab's CI/CD configuration could permit an unauthenticated attacker to execute arbitrary code on the server. This exploit arises from insufficient validation of a specially crafted regular expression. Affected versions include GitLab CE/EE 19.2 prior to 19.2.8, 19.3 prior to ...

The CoAP component of Apache Camel contains a vulnerability that allows the generation of error messages revealing sensitive information. When a response cannot be properly built due to issues such as type conversion failures, the system returns an error response containing internal details. This...

An issue has been identified in the Apache Camel A2A component that presents a Server-Side Request Forgery (SSRF) vulnerability. This flaw arises from discrepancies in how a webhook URL's host is validated. Specifically, hosts represented as IP literals can be matched against an outdated prefix l...

A vulnerability exists in Microsoft Windows Remote Desktop Protocol (RDP) that enables unauthorized attackers to execute arbitrary code over a network. The issue arises from the usage of uninitialized resources, which can lead to compromised systems if exploited. Proper patching and security meas...

The Apache Camel OAuth component experiences a vulnerability due to improper caching of OAuth 2.0 bearer tokens. The OAuthClientCredentialsTokenResolver stores tokens in a static cache, which is accessed by multiple instances and components. This design flaw allows different OAuth profiles, when ...

An improper limitation of a pathname in Apache Camel's Docling component allows arbitrary file writing in directories accessible to the Camel process. Specifically, when the CamelDoclingOutputFilePath header is set, it does not normalize the path, which means attackers can exploit this to create ...

A Path Traversal vulnerability exists in the Apache Camel Docling component, allowing external entities to influence command-line arguments. This flaw arises because the method intended to sanitize path-like arguments only checks for relative traversal, leaving absolute paths unverified. As a res...

The Apache Camel Keycloak component is vulnerable to insufficient session expiration due to the way token introspection results are cached. When the introspection feature is enabled, the system incorrectly accepts expired tokens, as it only checks if a token is active without comparing the expira...

An Expression Language Injection vulnerability in the AWS2-S3 component of Apache Camel allows unauthorized manipulation of expressions used in messages. The flaw exists because the producer of the AWS2-S3 component sometimes evaluates headers containing dynamic keys improperly, which can lead to...

The Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb is vulnerable due to an unprotected API that allows remote users to manipulate the bulb's functionality without any authentication. This API flaw enables unauthorized individuals to turn the bulb on or off, alter its brightness, or c...

A vulnerability exists in the Apache Camel Saxon component where improper handling of XML External Entities enables an attacker to exploit the system. The default Saxon configuration lacks restrictions, allowing external DOCTYPE declarations and entities to be resolved upon parsing. This flaw may...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

EDK2 BIOS by TianoCore exhibits a serious vulnerability that enables malicious users to perform an out-of-bounds write due to improper buffer size calculations. This could be exploited remotely, leading to arbitrary code execution on affected systems. The implications of such exploitation extend ...

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default config...

The Contact Form by Supsystic plugin for WordPress, prior to version 1.11.1, is susceptible to email header injection due to improper handling of CR/LF characters in user submissions. This flaw allows unauthenticated attackers to inject arbitrary email headers into outgoing notification emails. S...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

The Zip Library for Rust, specifically version 9.0.4, has a vulnerability where it improperly reconciles filenames in Central Directory File Header with those in Local File Header during file extraction. This can lead to a scenario where an attacker crafts a ZIP archive that appears harmless base...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The Video Player for YouTube plugin for WordPress lacks proper capability checks on its player-preset AJAX handler. This vulnerability enables users with Contributor roles or higher to access site-wide player-preset configurations. Additionally, users running versions earlier than 2.1.1 may also ...

The Community Events WordPress plugin is susceptible to arbitrary web script injection due to inadequate authorization and nonce checks when handling public event submissions. This vulnerability allows unauthenticated users to inject and execute malicious scripts in the browser of administrators ...

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is susceptible to an authorization bypass vulnerability. This flaw is present in versions up to and including 6.5.8, where insufficient authorization checks allow authenticated users with Author-level access or higher to modify p...

The Chat AI with Dispatcher plugin for WordPress prior to version 2.4 is vulnerable to an exploit that allows unauthenticated attackers to upload arbitrary files. This occurs due to inadequate validation of uploaded files, where the system only checks a client-supplied content type that can be ea...

A vulnerability exists in the Two Factor Authentication and All-In-One Security plugins for WordPress, where the mechanism for verifying two-factor codes does not properly associate the authenticated account with the verified code. This allows an attacker who knows the victim's password to potent...

The LogixFast Auth plugin for WordPress contains a significant vulnerability where it mishandles password reset requests. Instead of sending the password-reset one-time code to the user's registered email, it sends this sensitive information to the email address specified in the request. This fla...

The GeoDirectory plugin for WordPress, prior to version 2.8.197, fails to enforce post password protection, which can lead to unauthorized users accessing content and custom fields of listings that are meant to be restricted. This oversight exposes sensitive information intended for authenticated...

The Automated Import Products to Cart plugin prior to version 1.0.4 in WordPress is susceptible to file path manipulation. The vulnerability arises from improper sanitization of user-supplied file paths, enabling users with minimal permissions—such as subscribers—to exploit this flaw. This insuff...

A flaw in the WP Photo Album Plus WordPress plugin prior to version 9.3.04.004 enables an attacker to exploit comment management features. By tricking a logged-in user with moderation rights into accessing a specially crafted page, attackers can potentially delete photo comments without authoriza...

A vulnerability exists in the SVG, WebP, and ICO Upload plugin for WordPress versions prior to 1.1.6, where the plugin fails to adequately sanitize SVG files. This oversight allows users with author permissions and higher to exploit animation elements in SVG files to change the link's target to a...

The WP Post Author plugin for WordPress, prior to version 4.2.0, has a critical security flaw that allows unauthenticated users to access sensitive integration settings. This includes the exposure of the reCAPTCHA secret key, which could lead to further security compromises. Proper restrictions o...

The Hide Price Until Login plugin for WordPress, before version 1.1.2, contains a security flaw that permits unauthorized users to register for an account. This vulnerability arises from a poorly restricted guest-registration handler, which fails to respect the site's user-registration settings. ...

The Wallet System for WooCommerce plugin for WordPress prior to version 2.8.2 is susceptible to an authorization bypass issue. This vulnerability allows authenticated users with minimum permissions, such as Subscribers or Customers, to manipulate the KYC document submission handler. Since the plu...

The Enable SVG, WebP, and ICO Upload plugin for WordPress prior to version 1.1.6 is susceptible to a stored cross-site scripting vulnerability. This flaw arises from the plugin's failure to adequately sanitize SVG file uploads when the content is misidentified. Users with author-level permissions...

The WP Post Author plugin for WordPress allows unauthenticated users to exploit a vulnerability where they can update the display name, nickname, and website of the first user account—typically the administrator's account—during front-end registration. This occurs without validating that the user...

The Frontend Dashboard and ProfileGrid plugins for WordPress are susceptible to a PHP object injection vulnerability. This flaw enables unauthenticated users to store malicious serialized PHP objects in user metadata, which are later deserialized when the public profile is accessed. Consequently,...

The LetterPress WordPress plugin, prior to version 2.4.0, has a significant vulnerability where certain settings are not properly sanitized and escaped. This loophole can potentially allow users with higher privileges, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks. ...

The Appointment Booking Plugin for WordPress, specifically versions prior to 5.7.6, is susceptible to a cross-site scripting vulnerability due to insufficient escaping of booking-form step content settings. This flaw enables high-privilege users, like administrators, to inject potentially malicio...

The PAYCOMET for WooCommerce plugin prior to version 5.46 has a significant vulnerability where the cryptographic signature is not verified on the payment notification endpoint during tokenisation operations. This oversight allows unauthenticated attackers to manipulate stored payment tokens link...

The vTables WordPress plugin versions prior to 0.3 contains a vulnerability that fails to properly sanitize and escape user input in SQL statements. This security flaw allows unauthenticated attackers to exploit the plugin, potentially facilitating SQL injection attacks. As a result, sensitive in...