Publicly Disclosed
PoC Exploits

Apache Airflow's scheduler is vulnerable due to the complete deserialization of XCom values generated by task code during the evaluation of task dependencies. This issue is significant as a Dag author can control the content written to XCom, which is subsequently deserialized within the scheduler...

A flaw has been identified in Keycloak that allows attackers with valid client credentials to exploit a weakness in the JWT Authorization Grant flow. This vulnerability permits an attacker to bypass signature verification and forge access tokens. Consequently, the attacker can impersonate any fed...

The FreeRDP software prior to version 3.33.0 contains a heap use-after-free vulnerability in the functions responsible for graphical updates, specifically update_gdi_patblt(), update_gdi_polygon_cb(), and update_gdi_mem3blt(). This flaw arises due to stale brush cache pointers that can be manipul...

A hardcoded cryptographic key management flaw exists in TP-Link's Archer C6 routers, stemming from the implementation of a universal cryptographic key shared across multiple devices. This weakness allows potential attackers to exploit encrypted configuration files or sensitive credential data, le...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

Akamai CLI versions prior to 2.0.6 are susceptible to a path traversal vulnerability that permits malicious actors to write files outside the intended install directory. This exploitation occurs via unvalidated values from the commands[].name field within the cli.json configuration file. Attacker...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A use-after-free vulnerability exists in the Android Binder service, which could allow attackers to elevate privileges from an application to the Linux Kernel. Exploitation of this vulnerability does not require any interaction from the user; however, it necessitates either the installation of a ...

The Happy Addons for Elementor plugin for WordPress is susceptible to stored cross-site scripting due to a lack of proper input sanitization and output escaping in the '_elementor_data' meta field. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to i...

A heap out-of-bounds write vulnerability exists in 7-Zip prior to version 26.06, specifically in the LZX decoder when handling multi-volume CAB archives. This vulnerability allows attackers to exploit a condition where a continuation CAB volume is declared with a smaller window, leading to memory...

The Happy Addons for Elementor plugin for WordPress is susceptible to stored cross-site scripting due to a lack of proper input sanitization and output escaping in the '_elementor_data' meta field. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to i...

A path traversal vulnerability exists in the Sooperset MCP-Atlassian product, specifically in the validate_safe_path function found in src/mcp_atlassian/utils/io.py. By manipulating the path argument, an attacker could potentially gain unauthorized access to sensitive files on the server. The vul...

The Cargo Shipping Location for WooCommerce WordPress plugin prior to version 6.0 is vulnerable due to inadequate restrictions on a REST API endpoint that governs order shipment status updates. This vulnerability allows unauthorized users to exploit an attacker-controllable value for authorizatio...

The FraudLabs Pro SMS Verification plugin prior to version 1.12.1 fails to implement a server-side limit for SMS message retries. This oversight allows unauthenticated users to send an unrestricted number of verification messages to any phone number they choose. As a result, malicious actors can ...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

A vulnerability has been identified in the OpenSCAP product whereby a heap-based buffer overflow may occur during the processing of specially crafted Extensible Configuration Checklist Description Format (XCCDF) documents. This flaw can be triggered when using the sds-compose option, potentially ...

The All in One Addons For WPBakery Page Builder plugin for WordPress allows a security oversight where a shortcode attribute is not properly validated. This vulnerability could permit users with a contributor role or higher to construct file paths leading to the inclusion and execution of arbitra...

The BulletProof Security plugin for WordPress, up to version 7.2, is vulnerable due to insufficient protection of security log files. Specifically, sensitive authentication data can be exposed as the plugin relies on access controls that may not be consistently enforced across all web-server conf...

The Zion Builder plugin for WordPress prior to version 3.6.17 allows authenticated users with Author roles or higher to upload unvalidated SVG files. The plugin fails to properly sanitize or validate the contents of these uploads, which can lead to the execution of malicious JavaScript in the bro...

The out-of-bounds read vulnerability in Windows Paint enables unauthorized attackers to potentially execute arbitrary code within a network context. This flaw could allow malicious entities to manipulate the application, leading to unauthorized actions being performed on affected systems. Users a...

Hugging Face Datasets version 5.1.0 is susceptible to an insecure deserialization vulnerability that facilitates arbitrary code execution. The flaw arises from the use of a deprecated pandas package builder, enabling attackers to create a malicious pickle file. When this file is processed using p...

A vulnerability exists in D-Link M60 version 1.12.B01 that affects the emDaemon MQTT Broker component, particularly in its configuration file located at /etc/emDaemon/mosquitto.conf. This vulnerability allows for the exploitation of hard-coded credentials, which can be accessed and manipulated re...

A security flaw exists in sunkaifei FlyCMS affecting the content rendering functionality, specifically within the ModelDataService.insertData method of articles/detail.html. This vulnerability allows remote attackers to perform cross-site scripting attacks by manipulating the content argument. Th...

A security flaw has been identified in the D-Link DCS-6501LH network camera, specifically within the Media Service component. The vulnerability is triggered by manipulating the 'pin_code' argument in the /mnt/conf/SystemConfig.ini file. This flaw allows for the exploitation of hard-coded credenti...

A vulnerability has been identified in the SourceCodester Smart Attendance System with QR Code Scanner version 1.0. The issue arises from an unknown functionality that is susceptible to cross-site request forgery (CSRF), allowing attackers to perform unauthorized actions on behalf of users. This ...

A vulnerability exists in the SourceCodester Smart Attendance System with QR Code Scanner 1.0, particularly within the file api/attendance_handler.php associated with the JSON Endpoint. An attacker can exploit this flaw by manipulating the 'student_code' argument, leading to the possibility of by...

A security flaw has been identified in the SourceCodester Smart Attendance System with QR Code Scanner 1.0, specifically within the getMessage function located in create_admin.php. This vulnerability allows unauthenticated users to manipulate the argument 'e', resulting in unauthorized access to ...

A vulnerability has been identified in the SourceCodester Smart Attendance System with QR Code Scanner, specifically in the reset_password.php file, which handles password resets. This flaw allows attackers to exploit weak password recovery protocols, potentially enabling unauthorized access. The...

A vulnerability has been identified in OpenTelemetry-Go versions 1.15.0 to 1.42.0, where the BSD kenv command is susceptible to PATH hijacking. The fix for a related issue altered the Darwin ioreg command to utilize an absolute path, yet overlooked the BSD kenv command, which remains vulnerable. ...

A security vulnerability has been identified within the braindecode product, specifically in the EEGModuleMixin._from_pretrained function located in braindecode/models/base.py. This flaw allows for path traversal when maliciously manipulating the filename argument. The vulnerability can be exploi...

A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in Pardus MyComputer developed by TÜBİTAK BİLGEM, potentially allowing unauthorized access and manipulation of system states. This issue impacts versions from 0.8.0 to prior 0.8.1, where the timing discrepancies between veri...

An OS Command Injection vulnerability exists within the Pardus Boot Repair software developed by TÜBİTAK BİLGEM. This flaw allows an attacker to manipulate OS commands executed by the system, potentially leading to unauthorized command execution. The issue specifically affects versions of Pardus ...

The Tabularis SQL injection vulnerability in versions prior to 0.28.0 allows attackers to exploit its SQLite driver. By crafting a malicious `table_name` when using the `describe_table` feature, an attacker can manipulate the PRAGMA command to execute stacked SQL statements. This could lead to un...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

GeoNode, a geospatial content management system, is exposed to a shell command injection vulnerability. This issue arises when a low-privileged remote user uploads a specially crafted vector file layer name. The injected shell syntax can be used to execute arbitrary operating-system commands on t...

JumpServer, an open-source bastion host and operation maintenance security audit system, has a security flaw in its Applet and VirtualApp upload functionalities. This issue allows users with administrative privileges to exploit the application through a Server-Side Template Injection (SSTI). The ...

The fsspec library, utilized for filesystem interfaces in Python, contains a flaw that allows remote code execution via specially crafted Kerchunk reference JSON documents. This vulnerability affects versions from 0.9.0 to 2026.6.0. By leveraging unrestricted template rendering, malicious users c...

The Stanza library, a powerful NLP tool developed by Stanford, is exposed to an arbitrary code execution vulnerability. This flaw arises from the way the library handles lemmatizer checkpoints. Specifically, in versions prior to 1.15.0, an attacker could supply a malicious lemmatizer checkpoint, ...

In HTTPX2, a next-generation HTTP client for Python, there exists a flaw in the Request._prepare() method found in src/httpx2/httpx2/_models.py. Before version 2.11.0, it is possible for the method to improperly add a Content-Length header that is derived from the request body while simultaneousl...

An authentication bypass vulnerability exists in LACT due to improper handling of UnixProcessSubject and Peer PID, which could allow unauthorized users to gain access to functionalities restricted to privileged accounts. This issue affects all versions of LACT up to 0.10.0. A patch has been imple...

A vulnerability has been identified in Pingora's handling of HTTP/1.0 request bodies and Transfer-Encoding values, which can lead to HTTP Request Smuggling attacks. This issue allows malicious actors to craft specially formatted requests that desynchronize Pingora’s request processing from backen...

The Open WebUI platform is vulnerable to a path traversal issue due to insufficient input validation in the terminal-server reverse proxy. This vulnerability allows an authenticated user to manipulate the `path` parameter, potentially leading to unauthorized access to sensitive files and endpoint...

A vulnerability has been discovered within the web-based management interface of AOS-CX switches by HPE. This issue could allow unauthorized actors to bypass existing authentication measures, potentially leading to unauthorized remote access. In certain scenarios, this vulnerability may also faci...

The git-diff tool prior to version 2.0.7 has a vulnerability that allows malicious users to inject shell commands. This is achieved by supplying specially crafted strings to the gitDiff API, enabling attackers to execute arbitrary commands with Node.js process privileges. Users leveraging diffed ...

The Nuxt framework prior to version 4.6.3 contains a vulnerability related to path manipulation, where it resolves literal or percent-encoded dot segments before rendering a page. This issue can allow for the unintended rendering of pages, such as /admin, despite server checks being designed to p...

OAuthLib, an OAuth implementation for Python, has a vulnerability in its token grant handling mechanism. Specifically, prior to version 4.0.0, it allows the client_credentials and Resource Owner Password Credentials grant handlers to incorrectly authenticate a request.client as a confidential cli...

ZITADEL versions 3.4.15 and earlier in the 3.x series, along with all 4.x versions prior to 4.19.2, are susceptible to an authentication bypass due to a flaw in the SAML identity provider's intent callback mechanism. This vulnerability occurs when the assertion signature verification process inco...

A security flaw has been identified in Turboderp-org's ExLlamaV3 software, specifically affecting versions up to 1.6.3. The vulnerability resides in the ngram_dequant function located in the ngram.cu file within the NGramEmbedding component. When the head_bias argument is manipulated, it can lead...

The filelock library, which provides a platform-independent file locking mechanism for Python, has a vulnerability present in versions 3.20.4 through 4.0.8. Specifically, the ReadWriteLock and AsyncReadWriteLock components resolve the lock path and pass it to SQLite without adequately rejecting t...

Argo CD, a continuous delivery tool for Kubernetes, is susceptible to command injection when handling SSH Git repositories with a proxy URL. This issue arises in versions from 2.11.0 to specific releases in the 3.x series, allowing users with the ability to create or modify repository configurati...