exploit

How the mentioned CVE works: The vulnerability stems from unsafe execution of the `check` field in uniget metadata. The `RunVersionCheck()`

The vulnerability (CVE-2023-49569) resides in how the `go-git` library, which uses `go-billy` for filesystem abstraction, processes symbolic links when handling

How the mentioned CVE works (around 20 lines): The Twig sandbox allow-list in `system/config/security.yaml` explicitly permits the `Config::toArray()` method for

The vulnerability arises because the `current_head` field of the `GitRepository` model is mutable via the REST API. In Nautobot versions

How the CVE works (technical details): The Routine model (wger/manager/models/routine.py) defines start/end date fields without maximum duration validation. The `clean()`

How the vulnerability works: The Traefik Kubernetes Gateway API provider incorrectly handles backend references whose names end with “@internal”. The

How the CVE Works The core of this vulnerability resides in `decompressGzip` (located in data/batch/batch.go:35-53), which uses `io.ReadAll` without limiting

The vulnerability exists in Authlib’s OpenIDImplicitGrant and OpenIDHybridGrant grants. Both validate_authorization_request methods check for the presence of the ‘openid’ scope

The vulnerability arises because Astro versions prior to 6.1.10 used AES-GCM encryption to protect server island props and slots but

The vulnerability stems from a flaw in OpenLearnX’s JSON Web Token (JWT) implementation. Specifically, the JWT signature verification process is

Technical Details – How the CVE Works The vulnerability resides in the `objToJSONFile()` function inside src/ujson/python/objToJSON.c. When `ujson.dump()` writes to

The vulnerability exists in the optional CORS proxy of SillyTavern versions prior to 1.18.0. The flaw resides in `src/middleware/corsProxy.js` at

The vulnerability arises from improper sanitization in the esm.sh service, which leverages esbuild and package.json to build modules. Specifically, the

The vulnerability exists in the `/api/extensions/delete` endpoint due to improper order of validation and sanitization. The endpoint accepts a JSON

How the mentioned CVE works: The vulnerability exists in SillyTavern’s CORS proxy endpoint at src/middleware/corsProxy.js:40. When a user requests a

How the vulnerability works: SillyTavern before 1.18.0 allows SSO via `Remote-User` (Authelia) or `X-Authentik-Username` (Authentik) headers. When `sso.autheliaAuth` or `sso.authentikAuth`

How CVE-2025-59342 works: The vulnerability exists in how esm.sh handles the X-Zone-Id HTTP header and processes NPM tarballs. Specifically, a

How the mentioned CVE works (technical details): SillyTavern uses `cookie-session` middleware for authentication, making sessions completely stateless. All user data

How the mentioned CVE works The vulnerability exists in sealed-env enterprise mode versions 0.1.0-alpha.1 through 0.1.0-alpha.3. When an unseal token

How CVE-2026-32686 Works The core of CVE-2026-32686 is the Decimal library’s failure to validate the exponent on parsed decimal input.

How the CVE Works (technical details): The dalfox REST API server binds to `0.0.0.0:6664` by default with no API key

How the CVE works (approx 20 lines): Dalfox REST API server binds to 0.0.0.0:6664 by default with no API key

The vulnerability exists in the OAuth callback handler of OpenClaude MCP authentication flow. A local HTTP server is started to

How CVE-2026-45090 Works ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The

How the mentioned vulnerability works: Dalfox server mode binds to 0.0.0.0:6664 by default with no API key required. The –api-key

The vulnerability resides in the `codegen` module used by `protobufjs` to compile Protocol Buffer schemas into JavaScript functions. The module

This critical remote code execution (RCE) vulnerability in the `protobufjs` npm package arises from unsafe dynamic code generation. The library

The vulnerability in pbts (a CLI tool for generating TypeScript definitions from protobuf JavaScript files) arises from the way it

The protobufjs decoder fails to impose a depth limit when recursively parsing nested Protocol Buffers messages. This flaw affects two

How the mentioned CVE works The vulnerability resides in protobufjs, a popular Protocol Buffer library for JavaScript. The library dynamically

How the CVE Works The vulnerability in `protobufjs` (versions prior to 6.11.3) stems from the way generated message constructors handle

How CVE-2023-36665 Works The core of the issue lies in how `protobufjs` handles options when parsing a Protocol Buffer schema

How CVE-2023-36665 Works protobufjs is a JavaScript implementation of Protocol Buffers for Node.js and browsers. The library uses plain JavaScript

The attack chains three vulnerabilities without a single CVE number. First, a `pull_request_target` workflow misconfiguration allows attacker-controlled code from a

The vulnerability resides in Mermaid’s default configuration which fails to properly sanitize CSS injected via the fontFamily, themeCSS, and altFontFamily

How the mentioned CVE works: The vulnerability exists in `PDFService._markdown_to_html()` at lines 171-176 of pdf_service.py. The function builds an HTML

How the Mentioned CVE Works This is an authorization bypass vulnerability in MantisBT’s private issue monitoring feature. The flaw resides

The vulnerability resides in MantisBT’s attachment handling logic. When a user uploads a file to an issue, the system associates

How CVE-2026-32763 works: The vulnerability exists in Kysely’s JSON path leg compilation. When an attacker controls input passed to `.key()`

This vulnerability allows an attacker to bypass the Content Security Policy’s `script-src` directive through a crafted attachment. The attack chain

How the mentioned CVE works Vulnerable Component: The ProjectUsersAddCommand, used by the web form (manage_proj_user_add.php) and the REST API endpoint

The flaw stems from a missing server‑side authorization check when the REST API handles attachment uploads. An unauthenticated attacker first

The vulnerability lies in MantisBT’s tag update page, which after processing a request redirects the user back to a previous

The root cause is a missing authorization check in the file visibility function of MantisBT. This flaw affects both the

The vulnerability stems from improper handling of the `font_family` parameter during user preference updates. When an authenticated user modifies their

The vulnerability exists because the MantisBT “Move Attachments” admin page fails to escape the project name when rendering it. An

How CVE-2026-40607 Works The vulnerability exists due to the incorrect escaping of a saved filter’s owner. When `$g_show_user_realname` is set

The vulnerability exists because the MantisBT `bug_update_page.php` script improperly escapes the contents of user-supplied data destined for textarea-type custom fields.

The core view rendering method `View::renderPhpFile()` in Yii2 versions prior to 2.0.55 calls `extract($_params_, EXTR_OVERWRITE)` before the `require` statement that

How the mentioned CVE works: The vulnerability exists in `bug_report_page.php` when cloning an issue from a different Project. The clone

The vulnerability resides in the `return_dynamic_filters.php` file. When a user provides a `filter_target` GET parameter (normally used to load custom

How the CVE Works In default MantisBT installations, users with the UPDATER role (access level 40) are granted the `update_bug_threshold`

How the CVE works (technical details): The vulnerability exists in Mermaid versions 11.0.0-alpha.1 through 11.14.0 and all 10.x up to

How CVE-2026-41150 Works This vulnerability resides in the Gantt chart renderer’s logic when handling the `excludes` attribute. The process is

How the mentioned CVE works: Gryph uses logging levels (minimal, standard, full) to control what gets logged to a local

How the mentioned CVE works This stored cross-site scripting vulnerability resides in MantisBT’s file download mechanism. By default, the `file_download.php`

How the mentioned CVE works: The vulnerability exists in Mermaid’s state diagram parser. The `classDef` directive is improperly sanitized. An

The vulnerability arises because `executorUtils.ts` builds host JavaScript functions via `createFunction()` that are indistinguishable from normal functions. A sandboxed script

How the CVE works: PraisonAI implements optional knowledge-store backends for SQL (SingleStore, PostgreSQL) and CQL (Cassandra). The public `KnowledgeStore` interface

The vulnerability resides in Gotenberg’s primary Chromium URL-to-PDF endpoint (/forms/chromium/convert/url). By default, the service applies a deny-list that only blocks

The vulnerability arises from an integer overflow in the internal `buffer_len(cap)` helper function of the `smallbitvec` crate. The function computes

The `SignedPublicKeysTrustValidatorImpl.isTrusted()` method discards the boolean result from `Signature.verify()` on line 45. While it performs certificate chain validation, OCSP checks,

How the mentioned vulnerability works (no CVE ID assigned, but flaw exists at commit 80a7b4c): The SSE HTTP transport in

The vulnerability resides in `EmlParser.get_raw_body_text()` (eml_parser/parser.py). For each part of type multipart/, the function iterates over its sub‑parts. When a

The vulnerability stems from how the JSX renderer serializes `style` object values. During server-side rendering (SSR), untrusted input placed into

How CVE-2026-44966 Works The vulnerability resides in how Velocity.js processes `set` directives within its templating engine, specifically in the path

The vulnerability exists in the preview routing mechanism of the ViewComponent Ruby gem (used with Rails). The preview route extracts

The vulnerability resides in the `domain_lookup` module, which exposes two unauthenticated HTTP POST endpoints: `/domain-lookup/check` and /domain-lookup/bulk. The module’s `buildTldxCommand()`

When server-side SNI is enabled in a Vert.x application, the TLS engine uses a cache to map SNI hostnames presented

How CVE-2024-28103 works: The system test entrypoint in `ViewComponentsSystemTestController` resolves a user-controlled file path using File.realpath. It then checks if

The vulnerability exists in `IArchive.WriteToDirectory()` where the directory‑entry branch lacks `Path.GetFullPath()` normalization and bounds checks before calling Directory.CreateDirectory. Two .NET

The vulnerability exists because the `set_value()` method of `GitConfigParser` in `git/config.py` (GitPython 3.1.49) only validates newlines in the `value` parameter.

The CVE works by exploiting an unvalidated HTTP Referer header that the application stores in a session variable. When a

The vulnerability resides in `hono/utils/jwt` where the `verify()` function fails to correctly validate the exp, nbf, and `iat` claims. The

The vulnerability arises from an oversight in Hono’s Cache Middleware component, specifically within the `httpCache` function. The middleware is responsible

The `mistune.math` plugin renders inline ($…$) and block ($$…$$) math by directly concatenating raw user input into the HTML output.

How the CVE Works The vulnerability originates in the `render_figure()` function within the `mistune/directives/image.py` module (lines 152-168). When processing a

How the vulnerability works (CVE not yet assigned, based on real code flaw): The `HTMLRenderer.heading()` method in `src/mistune/renderers/html.py` constructs an

How the CVE works The flaw resides in the UDR’s `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions` endpoint. To trigger it, an attacker first creates

How the mentioned CVE works (around 20 lines): The vulnerability resides in the `PatchIndividualApplicationPFDManagement` handler of free5GC’s NEF component (v4.2.1).

The vulnerability arises from improper sanitization of HTML generated from XLSX file attachments. When a user uploads a maliciously crafted

This CVE affects free5GC’s Session Management Function (SMF), specifically the User Plane Information (UPI) management route group. The root cause

The vulnerability exists because the NEF (Network Exposure Function) in free5GC v4.2.1 mounts the 3gpp‑traffic‑influence API endpoint without any inbound

The vulnerability arises from missing server-side role verification for users with “pending” status. Open WebUI defines three roles: user, admin,

How the mentioned CVE works: The vulnerability resides in free5GC’s NEF component, specifically in the PFD (Packet Flow Description) change

How the CVE works (approx. 20 lines): The vulnerability stems from `gitsign verify` and `gitsign verify-tag` re‑encoding commit/tag objects via

The vulnerability exists because the API endpoint `/api/v1/{object_type}/{id}/files` in `app/Http/Controllers/Api/UploadedFilesController.php` incorrectly authorizes requests using `view` permission instead of `write` or

How the CVE works: The vulnerability exists in Snipe-IT versions prior to 8.4.1 due to improper sanitization of the `permissions`

How the mentioned CVE works: The vulnerability exists in free5GC’s Policy Control Function (PCF) POST handler (HandleCreateSmPolicyRequest) at /npcf-smpolicycontrol/v1/sm-policies. When

The vulnerability resides in free5GC’s Network Exposure Function (NEF) which mounts the `nnef-pfdmanagement` route group without any inbound OAuth2 or

free5GC’s Network Exposure Function (NEF) exposes an OAM (Operations, Administration, Maintenance) route group at /nnef-oam/v1/. This route group is mounted

How the CVE works: The SMF mounts the `/upi` route group without OAuth2 middleware, unlike protected `/nsmf-oam` which returns 401.

The vulnerability (no official CVE yet, tracked as free5gc/free5gc926) resides in free5GC’s BSF component handling PUT /nbsf-management/v1/subscriptions/{subId}. The handler uses

free5GC’s Session Management Function (SMF) exposes the User Plane Information (UPI) management route group without OAuth2/bearer-token authorization middleware. A network

The vulnerability stems from inconsistent handling of glob pattern negations between the Golang and Python implementations of in-toto. in-toto-python uses

How the mentioned CVE works: The vulnerability exists in Open WebUI version 0.1.105. The /rag/api/v1/doc API endpoint handles file uploads.

The vulnerability lies in free5GC’s Network Exposure Function (NEF), which mounts the 3gpp-pfd-management API without enforcing any inbound OAuth2 or

The vulnerability resides in the free5GC UDR (Unified Data Repository) `nudr-dr` API endpoint. Specifically, the handler for the `DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions`

The vulnerability resides in the PCF’s POST `/npcf-policyauthorization/v1/app-sessions` handler. A single authenticated request triggers a panic when `ascReqData.suppFeat` is set

The vulnerability resides in the `BinaryField` class constructor within Math/BinaryField.php. phpseclib uses binary fields to represent elliptic-curve points. The constructor