exploit

CVE-2026-41894 is a critical path traversal vulnerability found in Si Yuan, an open-source digital knowledge base software. The vulnerability exists

How CVE-2026-54068 Works The vulnerability resides in the kernel router of SiYuan, an open-source personal knowledge management system. In the

How CVE-2026-54089 Works FileBrowser is a popular web-based file manager. In its default configuration, it uses JSON-based authentication (auth.method=json), which

How AIKIDO-2026-10918 Works Windmill supports scoped API tokens with a format of {domain}:{action}[:{resource}], allowing administrators to restrict tokens to specific

The SiYuan Note kernel HTTP server contains a critical authentication bypass vulnerability stemming from an overly permissive trust of the

Vulnerability CVE-2026-54067 is a critical stored Cross-Site Scripting (XSS) vulnerability in the SiYuan note-taking application that can lead to Remote

How CVE-2026-54063 Works This vulnerability resides in the `checkSheet()` function of the `github.com/xuri/excelize/v2` library, versions prior to 2.11.0. The library

How the CVE Works CredSweeper is an open-source credential scanning tool developed by Samsung. It features a “deep scanning” mode

The vulnerability is an incomplete fix for the previously published GHSA-7r34-79r5-rcc9 (CVE-2026-27826). The original patch introduced `validate_url_for_ssrf` in utils/urls.py, which

tarteaucitron.js is a popular open-source cookie consent management library that provides websites with a compliant and accessible cookie banner for

The vulnerability exists in the `@libp2p/gossipsub` module of the `js-libp2p` networking stack. The core issue is that the `gossipsub` protocol

Kimai versions up to and including 2.57.0 are vulnerable to a server-side request forgery (SSRF) attack within the invoice PDF

How CVE-2026-5078 Works Morgan is a popular HTTP request logging middleware for Node.js applications. It provides various pre-defined log formats

How CVE-2025-31485 Works API Platform Core is a popular PHP framework for building hypermedia-driven REST and GraphQL APIs. Prior to

How CVE-2026-53809 Works OpenClaw before version 2026.4.25 contains a policy bypass vulnerability in its embedded runner policy. The flaw arises

How CVE-2026-53825 Works OpenClaw before version 2026.4.7 contains an arbitrary file read vulnerability within the memory-wiki ingest feature. This feature

How CVE-2026-53823 Works OpenClaw before version 2026.5.3 contains a privilege escalation vulnerability in the `allowFrom` feature. The `allowFrom` mechanism is

How CVE-2026-34507 Works OpenClaw before version 2026.4.29 contains a policy bypass vulnerability in the QQBot admin command handler. The flaw

How CVE-2026-32906 Works OpenClaw before version 2026.5.12 contains a privilege escalation vulnerability in its Slack plugin approval mechanism. The flaw

How CVE-2026-53838 Works OpenClaw before version 2026.5.27 contains a state mutation vulnerability in its node pairing reconnection mechanism. The flaw

How CVE-2026-53808 Works OpenClaw before version 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow. The

How CVE-2026-53819 Works OpenClaw before version 2026.5.27 contains an arbitrary code execution vulnerability in its skill installation flows. The root

How CVE-2026-53821 Works OpenClaw before version 2026.5.18 contains a critical authorization bypass vulnerability in its trusted-proxy Control UI WebSocket handling.

How CVE-2026-32905 Works OpenClaw before version 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin. The plugin exposes

Technical Deep Dive: CVE-2026-53833 CVE-2026-53833 is an authorization bypass vulnerability discovered in OpenClaw versions prior to 2026.4.29, specifically affecting the

How CVE-2026-53837 Works OpenClaw before version 2026.5.6 contains an improper access control vulnerability in its Mattermost event handlers. The flaw

Technical Analysis: How CVE-2026-53827 Works OpenClaw before version 2026.5.2 contains a credential exposure vulnerability in the `message.action` forwarding mechanism. The

How CVE-2026-53813 Works OpenClaw before version 2026.4.25 contains a path traversal vulnerability in its memory-core artifact loading process. The root

Technical Overview OpenClaw before version 2026.4.29 contains an incorrect authorization vulnerability (CWE-863) in its browser debug and export routes. The

How CVE-2026-53810 Works OpenClaw before version 2026.5.18 contains a critical code execution vulnerability stemming from insufficient validation of marketplace runtime

On POSIX nodes, OpenClaw’s `system.run` safe-bin checks evaluate a command’s safety before shell expansion alters its interpretation. This creates a

How CVE-2026-53822 Works This vulnerability resides in OpenClaw’s shell wrapper command execution flow, specifically within the `system.run` functionality that processes

How CVE-2026-53812 Works OpenClaw is a personal AI assistant that includes a browser control feature powered by Playwright, allowing authenticated

CVE-2026-53817 is a vulnerability in OpenClaw versions prior to 2026.5.22 that stems from insufficient locality validation during the Control UI

How CVE-2026-35674 Works OpenClaw before version 2026.5.18 contains a scope bypass vulnerability in the Gateway `chat.send` route that allows scoped

How CVE-2026-35630 Works OpenClaw’s QQBot channel provides native approval buttons that allow authorized approvers to approve pending `exec` and plugin

Technical Deep Dive – How CVE-2026-53820 Works OpenClaw is a personal AI assistant that exposes a bundled MCP (Model Context

How CVE-2026-53815 Works OpenClaw before version 2026.5.19 contains an authorization bypass vulnerability in message read actions that fails to enforce

How CVE-2026-53829 Works OpenClaw versions prior to 2026.5.18 contain an approval display truncation vulnerability that allows authenticated users to hide

The BalancerForward proxy helper in the GoFiber framework contains a critical security misconfiguration that allows attackers to spoof their IP

How CVE-2026-9795 Works CVE-2026-9795 is a privilege escalation vulnerability found in Keycloak’s Fine-Grained Admin Permissions (FGAPv2) feature. The core issue

How the Vulnerability Works The `@apify/actors-mcp-server` package builds Actor standby URLs by concatenating a trusted base URL with an attacker-controlled

CVE-2026-50138 is a vulnerability in the `goshs` Go package, a SimpleHTTPServer that supports file uploads, downloads, and WebDAV functionality. The

The vulnerability arises from improper cache isolation in Ghost’s frontend when deployed behind a shared caching layer (e.g., Fastly, Cloudflare,

oras-go implements the OCI distribution-spec monolithic blob upload flow, which consists of two sequential HTTP requests: an initial `POST` to

How CVE-2026-54291 Works This vulnerability resides in the `com.ongres.scram:scram-client` library, versions 3.1 and 3.2, which is bundled with the PostgreSQL

How CVE-2026-53840 Works OpenClaw supports remote MCP (Model Context Protocol) Streamable HTTP servers, allowing operators to configure custom headers—such as

The vulnerability resides in the `ensureLinkPath` helper function within `content/file/utils.go` (lines 262–275). This function is responsible for validating that a

How the Vulnerability Works The vulnerability resides in the `ShareHandler` of goshs, specifically within the token redemption logic for share

How CVE-2026-44936 Works Fleet is a GitOps continuous delivery tool for Kubernetes clusters. It watches Git repositories for changes and

How the CVE Works In SurrealDB, the `RELATE` statement is used to create a directed edge record between two existing

How CVE-2025-11060 Works CVE-2025-11060 is an incorrect authorization vulnerability in SurrealDB’s live query subscription mechanism. The core issue lies in

How CVE-2026-44939 Works This vulnerability resides in the Rancher Manager cluster import endpoint at /v3/import/{token}_{clusterId}.yaml. The endpoint accepts an `authImage`

How the CVE Works The `KILL` statement in SurrealDB is designed to terminate active `LIVE SELECT` subscriptions that stream real‑time

SurrealDB versions prior to 3.1.0 contain a pre-authentication memory amplification vulnerability in the `/sql` WebSocket upgrade handler. The vulnerability stems

How CVE-2026-49998 Works Centrifugo’s dynamic JWKS endpoint feature allows administrators to configure templated URLs that resolve to different JSON Web

How the CVE Works SurrealDB, a multi-model database, provides an `UPDATE … PATCH` statement that allows callers to modify records

How the CVE Works When a user configures `ALGORITHM ES512` for any JWT access method using the `DEFINE ACCESS …

This vulnerability affects SurrealDB, a real-time multi-model database, and allows an authenticated user with UPDATE permissions to read the values

SurrealDB provides `http::` functions that enable authenticated users to make outbound HTTP requests to external network endpoints. Access control is

How CVE-2026-49997 Works SurrealDB allows records to be connected as a graph using a `RELATE` statement, which creates an edge

Technical How CVE-2026-49457 Works CVE-2026-49457 is a critical vulnerability in the Erlang QUIC client implementation (erlang/quic) that completely breaks TLS

CVE-2026-41050 is a critical privilege escalation vulnerability in Rancher Fleet that breaks the multi-tenant isolation model. The flaw exists in

How CVE-2026-44938 Works CVE-2026-44938 is a high-severity vulnerability identified in Rancher Fleet’s agent-side deployer. The core of the issue lies

How CVE-2026-44938 Works A vulnerability has been identified in Fleet’s agent-side deployer, which did not filter security-sensitive keys from `namespaceLabels`

How CVE-2025-11060 Works A `LIVE SELECT` subscription in SurrealDB records the user’s authentication state ($auth, $token, $session, $access) at the

How the Vulnerability Works The vulnerability resides in the `ArchiveUtils.untar(InputStream, Path)` and `ArchiveUtils.unzip(InputStream, Path)` methods of the `land.oras:oras-java-sdk` library (versions

How CVE-2026-41052 Works CVE-2026-41052 is a privilege escalation vulnerability in Rancher Manager that stems from overly permissive default role definitions.

How the Vulnerability Works A record user with table-level `SELECT` permissions can learn the value of a field that is

How CVE-2026-41053 Works A vulnerability has been identified within Rancher Manager in the GitHub App authentication provider. When evaluating permissions,

How CVE-2026-45710 Works CVE-2026-45710 is a memory-exhaustion denial-of-service vulnerability affecting Mailpit, a popular email testing tool. The vulnerability stems from

How the CVE Works The vulnerability resides in the `ciphertextContainer.UnmarshalJSON` method within the Contrast Coordinator’s transit engine API (coordinator/internal/transitengineapi/crypto.go). This

How CVE-2026-39379 Works GeoNetwork is an open-source catalog application for managing spatially referenced resources. It uses AngularJS for its frontend,

The vulnerability exists in auth-fetch-mcp v3.0.1 within the assertSafeUrl() function in src/security.ts, which is designed to block requests to private

The vulnerability resides in Repomix’s MCP server implementation, specifically within the interaction between the `attach_packed_output` and `read_repomix_output` tools. The server

How GHSA-2wwr-9x6f-88gp Works EasyAdminBundle provides two public Twig components: “ and <twig:ea:Icon name=”…”>. These components load SVG files from the

The `–remote-branch` CLI option in repomix is vulnerable to argument injection (CWE-88). User-supplied input is passed directly to `git fetch`

The MSI (Molecular Simulations Inc.) format reader inside Open Babel parses periodic cell translation vectors from an input file and

How the Vulnerability Works (CVE-2023-45821) The vulnerability arises from an insecure registry matching logic in the imagepuller component. When the

How the Mentioned CVE Works The vulnerability exists in how the Cortex MCP server (neuro-cortex-memory) handles the `CLAUDE_PROJECT_DIR` environment variable.

How the CVE Works The vulnerability resides in the `valid_signature?` method of the Pay::Webhooks::PaddleBillingController. This method is responsible for verifying

How CVE-2026-46636 Works The vulnerability resides in Twig’s sandboxing feature, specifically how the security policy for filters, tags, and functions

How the CVE Works The jshookmcp network domain implements a centralized SSRF authorization policy designed to block access to private,

How CVE-2026-46487 Works GeoNetwork’s Elasticsearch-backed search API is designed to inject access-control and visibility filters into every incoming search request

The `spatie/schema-org` package provides a fluent builder for Schema.org types and an LD+JSON generator. Affected versions (≥3.23.1, <3.23.2 and ≥4.0.0,

How the Mentioned CVE Works This vulnerability resides in the wetty client’s handling of terminal escape sequences for file downloads.

How CVE-2022-43607 Works Open Babel is a widely used open-source C++ library and command-line toolkit for converting, processing, and analyzing

The vulnerability resides in the ORCA file format parser of Open Babel, a C++ library and command‑line tool for converting

How CVE-2025-10998 Works Open Babel is a C++ library and command-line tool used extensively in computational chemistry and cheminformatics to

The vulnerability resides in the CSR (Chemical Structure Response) format parser of Open Babel, a widely used cheminformatics C++ library

How CVE-2022-44451 Works The vulnerability resides in the MSI (Molecular Simulation Inc.) format parser of Open Babel, a widely used

The PQS (Protein Quaternary Structure) file format parser in Open Babel contains a memory‑safety vulnerability that manifests as an out‑of‑bounds

How CVE-2025-10999 Works Open Babel is a widely-used open-source C++ library and command-line tool for interconverting between various chemical file

A memory‑safety vulnerability exists in Open Babel’s PQS (Parallel Quantum Solutions) file format parser, identified as CVE‑2025‑11000. The flaw resides

A memory-safety vulnerability exists in Open Babel’s Gaussian output parser that allows an out-of-bounds write when processing a specially crafted

How CVE-2022-46280 Works Open Babel is a widely-used C++ library and command-line tool for converting and manipulating chemical file formats.

Intro CVE-2022-46293 is a memory-safety vulnerability in the MOPAC output parser of Open Babel, a C++ library and command-line tool

How CVE-2025-10997 Works Open Babel is a C++ library and command-line tool used to convert and manipulate chemical file formats.

How CVE-2025-10996 Works CVE-2025-10996 is a memory-safety vulnerability residing in the SMILES parser of the Open Babel chemistry toolkit. The

How the CVE Works This vulnerability resides in Probo’s `saferedirect` package, which is responsible for validating redirect URLs across critical