Publicly Disclosed
PoC Exploits

The node-tar library, utilized for handling tar files in Node.js, has a security flaw affecting versions up to 7.5.2. This vulnerability arises from an inadequate sanitization of link paths in both hardlink and symbolic link entries when the preservePaths option is disabled (which is the default ...

An SQL injection vulnerability exists in specific versions of Django prior to 5.1.14, 4.2.26, and 5.2.8. Through the use of specially crafted dictionaries, attackers can exploit the `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()` methods, as well as the `Q()` class, when utilizing...

An information exposure vulnerability exists in Hitachi's Ops Center API Configuration Manager, Configuration Manager, and Device Manager, which could enable unauthorized session hijacking. This flaw affects multiple product versions, potentially exposing sensitive information to attackers. It is...

The vulnerability in the Windows Kernel involves an untrusted pointer dereference that enables authorized attackers to escalate privileges on affected systems. By exploiting this flaw, attackers can gain elevated permissions, potentially leading to unauthorized access and control over system reso...

A vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) handling arises when processing Address Configuration (ASCONF) chunks. Specifically, the system allows for a potential memory corruption scenario by failing to protect the transport cached in the ASCONF structure. A...

A buffer overflow vulnerability exists in the Diameter Rx Handler of Open5GS due to improper handling of arguments in the pcrf_rx_aar_cb function. This issue enables a remote attacker to exploit the vulnerability by manipulating the num_of_media_component/num_of_sub parameters. Successful exploit...

A vulnerability exists in Open5GS versions up to 2.7.1 affecting the Diameter S6a Interface. Specifically, the function mme_s6a_subscription_data_from_avp is susceptible to a heap-based buffer overflow due to improper argument manipulation of msisdn_len. This flaw can potentially be exploited rem...

A stack-based buffer overflow vulnerability has been identified in the Diameter S6a Interface of Open5GS, affecting versions up to 2.7.1. The flaw resides within the hss_ogs_diam_s6a_air_cb and hss_ogs_diam_s6a_ulr_cb functions in the file src/hss/hss-s6a-path.c. By manipulating the argument os.l...

Typemill CMS version 2.x has a persistent cross-site scripting vulnerability due to improper handling of Markdown links. Authenticated users with theme-configuration access can inject malicious JavaScript URIs via unsanitized href values. By manipulating Markdown links through ParsedownExtension....

Weaver E-cology versions 8.0 and 9.0 have a vulnerability in the HrmCareerApplyPerView.jsp endpoint that permits unauthenticated remote attackers to execute SQL injection attacks. By manipulating the unsanitized 'id' GET parameter, attackers can send crafted requests to extract arbitrary data fro...

Weaver E-cology 8.0 contains an SQL injection vulnerability in the SignatureDownLoad servlet. This flaw permits unauthenticated remote attackers to perform arbitrary file reads by injecting a UNION SELECT payload into the markId GET parameter, which is directly appended into a SQL query without p...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

An input validation flaw in Amazon Bedrock AgentCore may permit an authenticated remote user to execute predefined tools, circumventing standard model invocation and security protocols through specially crafted content blocks embedded in conversation messages. AWS has resolved the issue, and no f...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A use-after-free vulnerability has been identified in the JIT component of the JavaScript engine within Mozilla's Firefox browser. This flaw can lead to memory corruption issues, potentially allowing attackers to execute arbitrary code or cause unexpected behavior in affected Firefox versions, sp...

This vulnerability is identified as an issue in the JavaScript Engine of Mozilla Firefox, specifically within the JIT (Just-In-Time) compilation process. It allows attackers to exploit a use-after-free condition, potentially enabling arbitrary code execution. The flaw impacts various versions of ...

A buffer overflow vulnerability was identified in Samsung mobile devices utilizing Exynos chipsets, particularly impacting software versions O(8.x), P(9.0), and Q(10.0). This exploit arises from an abnormal SETUP message sent to the baseband component, which could allow for the execution of arbit...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The ThrottleStop driver, a legitimate component from TechPowerUp, presents a vulnerability due to insecure IOCTL interfaces that permit arbitrary read and write access to the physical memory through the MmMapIoSpace function. This flaw can be exploited by malicious applications running in user mo...

The Ray Enterprise Translation WordPress plugin, up to version 1.7.3, is susceptible to an improper authorization vulnerability due to the lack of capability and nonce checks on specific AJAX actions. This oversight permits any authenticated user, even those with minimal permissions like Subscrib...

The Ray Enterprise Translation plugin for WordPress versions up to 1.7.3 allows authenticated users, including those with minimal privileges such as Subscribers, to exploit an insufficient access control mechanism. This vulnerability arises from the plugin's failure to enforce capability or nonce...

A vulnerability in the Linux kernel relates to improper handling of the garbage collection status during socket communications. Specifically, the unix_gc() function may execute without properly setting gc_in_progress to true, potentially leading to erroneous behavior in the garbage collection pro...

The dataSIMS Avionics ARINC 664-1 version 4.5.3 includes a vulnerability that could be exploited through a local buffer overflow. By manipulating the milstd1553result.txt file, attackers may craft a malicious file with specific payload and alignment sections, enabling them to overwrite memory and...

The image-size library through version 2.0.2 contains a vulnerability that allows a remote attacker to induce a denial of service by sending a specially crafted image buffer with a zero-valued size field. This input can manipulate the Node.js event loop, resulting in an infinite loop during the i...

A vulnerability exists in the Windows Event Logging Service due to a failure in its protection mechanisms, allowing an authorized attacker to potentially disclose sensitive information across a network. This could lead to unauthorized access to sensitive data or system information, emphasizing th...

The Joomla Content Editor (JCE) prior to version 2.20.2 is affected by an improper input validation vulnerability. This flaw permits authenticated users with file management permissions to rename files, even to invalid names, which can lead to the creation of hidden files. Additionally, this flaw...

The Sucuri Security WordPress plugin, up to version 2.7.3, suffers from a path traversal vulnerability within the pageIntegritySubmission() method in src/integrity.lib.php. This flaw enables authenticated administrators to delete arbitrary files by inserting directory traversal sequences into the...

A path traversal flaw exists in Unearth version 0.18.2, specifically within the is_within_directory function. This vulnerability arises because the application does not properly normalize file paths before validating them, allowing attackers to exploit this oversight. They can create malicious ta...

The SQLBot dashboard component is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of user-provided content rendered through TinyMCE. This flaw allows attackers with access to modify the dashboard text widgets to inject malicious HTML and JavaScript. Consequently, any ...

Cachet versions up to 2.4.1 are vulnerable to server-side template injection, allowing authenticated users to exploit incident templates. By crafting malicious incident templates using Blade directives or Twig filters, attackers can execute arbitrary PHP code and potentially gain control of the w...

In FlyEnv versions before 4.18.0, the application does not adequately sanitize HTML content generated from markdown and AI chat inputs before rendering it into the DOM using Vue's v-html directive. This flaw allows attackers to inject and execute malicious scripts within the Electron renderer pro...

The Spacebar Server prior to commit 8d126f4 exhibits a vulnerability allowing authenticated users with MANAGE_MESSAGES permission to delete messages across different channels. This flaw arises from the inadequate scoping of message deletion requests, enabling malicious actors to exploit the delet...

The Spacebar Server prior to commit 8d126f4 exhibits a vulnerability allowing authenticated users with MANAGE_MESSAGES permission to delete messages across different channels. This flaw arises from the inadequate scoping of message deletion requests, enabling malicious actors to exploit the delet...

Hugging Face Accelerate versions up to 1.14.0 are susceptible to a path traversal vulnerability found in the load_checkpoint_in_model and load_checkpoint_and_dispatch functions. This issue arises from improper sanitization of weight_map entries that are sourced from sharded checkpoint indexes. An...

CyberPanel version 2.4.3 has a vulnerability in its remote backup feature, allowing authenticated attackers to execute arbitrary code. By manipulating the SSH key retrieval process, an attacker can supply a malicious remote server address, leading to the unauthorized addition of their SSH public ...

Flowise versions 2.2.4 through 3.1.4 are vulnerable to a missing authorization issue in the POST /api/v1/openai-assistants-file/download endpoint. This flaw permits unauthenticated attackers to access private files by taking advantage of the endpoint's improper handling of session and API key ver...

MCPJam Inspector, designed for local-first development on MCP servers, has a vulnerability allowing remote code execution (RCE) due to improper binding settings. In versions 1.4.2 and earlier, the platform listens on 0.0.0.0 by default, enabling attackers to exploit this configuration through cra...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Postiz, an open-source social media scheduling tool developed by Gitroom, has a vulnerability that allows unauthenticated remote attackers to exploit the file handling mechanism. The application's upload route improperly manages URL paths, permitting attackers to access any file the application p...

tar-rs versions 0.4.11 to 0.4.46 possess a vulnerability in the Builder::append_dir_all() function, allowing attackers to exploit symlink behavior. This flaw enables unauthorized file access by allowing symlinks to bypass the designated source root directory. When an archived process is conducted...

NVIDIA GeForce Now for Android includes a flaw within its game launcher component, where a malicious application on the same device can intercept and process implicit intents designed for the streamer component. This vulnerability can be manipulated to enable unauthorized information disclosure, ...

The vulnerability in Spring Retry allows an attacker to send numerous unique requests that overwhelm the application’s stateful retry cache. Once this cache reaches its limit, it prevents any further updates, leading to a failure in all subsequent stateful retries and circuit breaker operations. ...

A path handling issue in Apple Private Cloud Compute may allow attackers positioned within a privileged network to exploit the vulnerability and leak sensitive information. This potential security weakness has been addressed with improved validation in PCC Release 5E290.3, enhancing the overall p...

A vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) handling arises when processing Address Configuration (ASCONF) chunks. Specifically, the system allows for a potential memory corruption scenario by failing to protect the transport cached in the ASCONF structure. A...

A vulnerability exists in the Sina Weibo Android SDK 4.2.7 where an intent redirection issue allows unexported Activities to be launched unexpectedly by the WbShareTransActivity. This could lead to unauthorized access and potential compromise of application security, making it crucial for develop...

Bitwarden Server prior to version 2026.7.2 contains a vulnerability that allows any authenticated user to send a POST request to the /collect endpoint without verifying their membership in the respective organization. This flaw enables users to forge audit log entries, potentially leading to sign...

The vulnerability CVE-2024-29943 affects Firefox, allowing attackers to perform an out-of-bounds read or write on a JavaScript object, enabling remote code execution and sandbox escape. The flaw was exploited during the Pwn2Own Vancouver 2024 hacking competition and affected Firefox versions befo...

The WooCommerce WordPress plugin prior to version 2.0.2 is susceptible to a file upload vulnerability due to its failure to validate the types of files that can be uploaded when its accepted-types setting is left empty. This lack of validation opens the door for unauthenticated attackers to uploa...

The Duplicate Post plugin for WordPress, prior to version 1.5.5, has a significant security flaw where it fails to enforce proper authorization checks during its bulk copy and delete functionalities. This oversight allows any user with access granted by an administrator to delete posts across the...

The FoodBoxBooker plugin for WordPress prior to version 1.0.8 is susceptible to an improper authorization vulnerability. This flaw enables authenticated users with Subscriber-level access or higher to update profile details of any user on the system, including those with administrative privileges...