Publicly Disclosed
PoC Exploits

A security issue has been identified in Helm, the package manager for Kubernetes Charts. Versions 4.0.0 through 4.1.3 are impacted by a flaw that allows a specially crafted Helm plugin to write files to arbitrary locations on the filesystem when installed or updated. To mitigate this risk, it is ...

A command injection vulnerability exists in the Apache Camel Docling component due to improper validation of custom CLI arguments. The vulnerability arises when the DoclingProducer constructs an argument list for the external 'docling' command-line tool, where insufficient validation may allow an...

In Cursor Code Editor versions prior to 1.3, a significant vulnerability exists allowing attackers to execute arbitrary code remotely. This occurs through manipulation of a trusted MCP configuration file either within a shared GitHub repository or on the target machine. If an attacker can alter t...

The OpenSLP service in VMware ESXi contains a heap overflow vulnerability that could allow an attacker within the same network segment to execute arbitrary code. By sending specially crafted packets to port 427, an unauthorized actor may exploit this flaw, potentially compromising the entire syst...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability exists in the Harness platform, specifically within the gitspaces component, affecting versions up to 2.28.2. The issue is located in the getAuthorizedSpaces function of the app/api/controller/gitspace/list_all.go file. It allows unauthorized users to bypass authorization, potenti...

A command injection vulnerability has been identified in the OpenLLM 0.6.30, specifically within the async_run_command function located in src/openllm/common.py. This flaw allows an attacker to manipulate the cmd argument, potentially leading to unauthorized command execution on affected systems....

The Joomla extension Page Builder CK contains a vulnerability that allows unauthenticated attackers to upload arbitrary files. This weakness can be exploited to upload executable files, resulting in remote code execution on the server. The implications of this vulnerability are severe, as it may ...

A vulnerability identified in Flask-MonitoringDashboard, up to version 5.0.2, facilitates cross-site request forgery attacks. This issue allows attackers to exploit certain functions without proper authorization, potentially leading to unauthorized actions performed on behalf of legitimate users....

A memory management vulnerability in the Linux kernel's eventpoll subsystem allows for a misuse of freed memory, resulting from improper handling of file structures during critical operations. The flaw occurs when an ep_remove operation clears a file pointer under lock while allowing concurrent o...

The Appointment Booking Calendar Plugin for WordPress, up to version 1.1.28, fails to validate user input before it is processed by a PHP deserialization function. This flaw exposes the plugin to attacks from unauthenticated users, who could exploit the vulnerability to inject arbitrary PHP objec...

The Frontend File Manager Plugin for WordPress, version 23.6, is susceptible to a vulnerability that allows unauthenticated users to delete arbitrary files on the server without proper validation of file paths derived from user input. This issue is particularly concerning when guest upload mode i...

The vulnerability arises from a logic error in the key-based pairing process of certain Android devices. This flaw may allow an attacker in proximity to exploit the issue and gain unauthorized access to sensitive user information, including conversations and location data. Notably, the attack doe...

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

An SQL injection vulnerability exists in specific versions of Django prior to 5.1.14, 4.2.26, and 5.2.8. Through the use of specially crafted dictionaries, attackers can exploit the `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()` methods, as well as the `Q()` class, when utilizing...

The OAuth implementation in phpBB has a critical flaw where improper authentication checks can lead to account hijacking. This vulnerability is particularly concerning as it may allow unauthorized users to gain access to accounts even if OAuth is not configured or enabled. Default installations a...

A use after free vulnerability in the CSS handling of Google Chrome versions prior to 147.0.7727.101 enables remote attackers to execute arbitrary code. This vulnerability can be triggered through a maliciously crafted HTML document, allowing unauthorized actions within a sandboxed environment, w...

A vulnerability has been identified in Hyland Perceptive Filters versions prior to December 8, 2023. This issue affects products like Cisco IronPort Email Security Appliance Software and Cisco Secure Email Gateway, along with several non-Cisco products. Attackers can exploit this flaw by crafting...

A vulnerability exists in the command-line interface (CLI) of Cisco Secure Email Gateway due to improper input validation. This security flaw allows authenticated, remote attackers to inject malicious operating system commands into legitimate commands. A successful exploitation of this vulnerabil...

A vulnerability exists within the Web UI and administrative CLI of Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA). This security flaw enables both authenticated local and remote attackers to escalate their privileges, potentially gaining root access on the device. T...

The webservices in Proofpoint Enterprise Protection (PPS/POD) are susceptible to a vulnerability that enables unauthorized users to execute remote code through 'eval injection'. Exploitation of this vulnerability necessitates network access to the webservices API; however, such access is typicall...

The webutils component of Proofpoint Enterprise Protection is affected by a vulnerability that permits an authenticated user to leverage eval injection for remote code execution. This vulnerability affects all versions up to and including 8.20.0, potentially allowing malicious actions by users wi...

A significant SQL injection vulnerability has been identified in the Hotel and Tourism Reservation application by Code-Projects, specifically within the Room Management Page component. The vulnerability arises from the manipulation of an argument within the /admin/rooms.php file, allowing an atta...

Cognee, prior to version 1.2.0, exhibits an improper access control vulnerability that allows unauthenticated attackers to register an account and modify global LLM provider configurations through the settings endpoint. This endpoint does not enforce necessary administrative checks, enabling atta...

The FluxInk Color Management Driver (TcnPeripheral64.sys) version 1.0.7.2 contains a security flaw that allows a standard user account to escalate privileges by mapping arbitrary physical memory. This vulnerability poses a significant risk, enabling unauthorized users to gain elevated access and ...

NocoBase, up to version 2.1.20, exhibits a server-side request forgery vulnerability within the serverRequest wrapper. This flaw permits authenticated administrators to make unauthorized outbound HTTP requests by inputting malicious URL links into workflow request nodes, custom action buttons, or...

A vulnerability has been identified in the Linux kernel concerning the KVM x86 module, specifically a use-after-free scenario due to an unexpected role in shadow paging. This issue arises when a host modifies a Page Directory Entry (PDE) mapping from outside a guest virtual machine and subsequent...

A vulnerability exists within the RAR5 recovery-volume parser used in WinRAR and UnRAR, leading to potential heap corruption through crafted .rev files. This flaw stems from the incorrect validation of input that allows for manipulation of internal data structures, posing a risk when users perfor...

GeoServer, an open-source server enabling geospatial data sharing and manipulation, contains a vulnerability that permits unauthenticated users to execute arbitrary code. This flaw arises from the handling of OGC request parameters, where property names are unsafely evaluated as XPath expressions...

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default config...

The web server binary '/bin/httpd' contains a vulnerability that enables a hidden backdoor authentication mechanism within its login function. This flaw allows unauthorized access by reading a backdoor password from the device configuration file if normal authentication fails. Using a direct comp...

A vulnerability has been identified in the Linux kernel concerning the KVM x86 module, specifically a use-after-free scenario due to an unexpected role in shadow paging. This issue arises when a host modifies a Page Directory Entry (PDE) mapping from outside a guest virtual machine and subsequent...

Vtiger CRM versions prior to 8.4.0 are subject to an authenticated file upload vulnerability that allows low-privileged users to perform remote code execution. This is achieved by uploading a .phar file containing malicious PHP code through the Documents module, circumventing the configured denyl...

Vtiger CRM versions up to 8.4.0 contain a vulnerability that permits authenticated users with administrative privileges to execute arbitrary PHP code remotely. This occurs via the ModuleManager's import feature, which allows crafted zip files to be uploaded without sufficient validation. Attacker...

The MSI Feature Manager, through its KernCoreLib64.sys kernel driver, introduces a local privilege escalation vulnerability. This flaw enables any locally authenticated user to execute arbitrary read/write operations on physical memory and conduct unrestricted I/O port operations. By exploiting e...

A vulnerability has been identified in the Linux kernel concerning the KVM x86 module, specifically a use-after-free scenario due to an unexpected role in shadow paging. This issue arises when a host modifies a Page Directory Entry (PDE) mapping from outside a guest virtual machine and subsequent...

Active Directory Domain Services Elevation of Privilege Vulnerability

The Windows NT OS Kernel contains a vulnerability that allows authorized attackers to exploit an integer underflow condition, which can lead to local privilege escalation. This design flaw may enable attackers to gain elevated privileges on affected systems, making it critical for users to apply ...

A vulnerability in the SP Page Builder for Joomla permits unauthenticated users to upload arbitrary files. This weakness can lead to the execution of PHP code, presenting significant security risks for Joomla websites using this extension.

Budibase, an open-source low-code platform, has a vulnerability that allows unauthenticated visitors to access and manipulate sensitive database documents. This issue primarily affects versions prior to 3.39.12. An attacker can exploit this flaw by sending an HTTP request to a published Budibase ...

GNU Bash versions up to 4.3 are vulnerable to a code injection flaw due to the mishandling of trailing strings after function definitions in environment variables. This vulnerability enables remote attackers to execute arbitrary code by crafting specific environment variables under various condit...

A remote code execution vulnerability found in React Server Components allows attackers to exploit improperly handled payloads. This issue affects versions 19.0.0 through 19.2.0, compromising server function endpoints through unsafe deserialization of HTTP request payloads. As a result, this flaw...

An authenticated arbitrary file upload vulnerability exists in the /admin/tinymce/upload endpoint of Webkul Krayin CRM version 2.2.x. This flaw enables attackers to upload crafted PHP files, which can subsequently lead to the execution of arbitrary code on the server. Such vulnerabilities can be ...

The Uncanny Automator Pro WordPress plugin versions prior to 7.3.0.6 were found to have a critical backdoor that was planted following a compromise of the vendor's update infrastructure. This malicious code allows attackers without authentication to gain administrative access to the affected site...

The WP Travel Engine plugin for WordPress fails to validate the source of user-supplied profile image paths effectively. This security flaw allows authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-i...

The DoLeads Integrator and wp2epub plugins for WordPress allow unauthorized users to install unverified extensions from wordpress.org. This creates a pathway for remote code execution (RCE), jeopardizing website security. Website administrators must ensure that these plugins are updated to mitiga...

The Frontend File Manager Plugin for WordPress, version 23.6, is susceptible to a vulnerability that allows unauthenticated users to delete arbitrary files on the server without proper validation of file paths derived from user input. This issue is particularly concerning when guest upload mode i...

In Livewire up to and including version 3.6.3, a vulnerability exists that allows unauthenticated attackers to execute commands remotely in certain configurations. This issue is caused by specific component property updates that are not adequately secured. Importantly, exploitation of this vulner...

Netdata, an open-source real-time infrastructure monitoring tool, contains a vulnerability that allows attackers to execute arbitrary commands on the Netdata agent. This occurs when an attacker establishes a streaming connection and triggers an alert, thereby exploiting the function `health_alarm...

The GNU Inetutils telnet daemon (telnetd) is vulnerable to a remote authentication bypass that can occur when an attacker manipulates the USER environment variable by specifying a '-f root' value. This flaw allows unauthorized users to gain access without proper authentication. Affected users sho...