exploit

The vulnerability exists in mitmproxy versions 12.2.1 and below when the built-in LDAP proxy authentication is enabled via the `proxyauth`

The vulnerability (CVE not assigned in ) arises from improper path validation in free5GC’s UDR service. The endpoint `PUT /nudr-dr/v2/application-data/influenceData/{influenceId}/{subscriptionId}`

CVE-2026-40169 is a moderate-severity heap buffer overflow vulnerability in ImageMagick versions prior to 7.1.2-19. The flaw, identified as a heap-based

The vulnerability exists in the free5GC UDR service’s DELETE endpoint: /nudr-dr/v2/application-data/influenceData/{influenceId}/{subscriptionId}. The handler is designed to only accept `influenceId` exactly

The vulnerability arises because Kyverno automatically injects its own service account bearer token into any `apiCall.servicecall` request that does not

The vulnerability exists in `response.redirect().back()` and `response.redirect(‘back’)` methods of @adonisjs/http-server. When called, the method reads the `Referer` header from the

ImageMagick suffers from a heap use-after-free vulnerability (CWE-416) when handling malformed XMP metadata. The flaw resides in the code that

The vulnerability stems from the `October\Rain\Support\SafeCollection` class implementing the `CallsAnyMethod` interface, which instructs the `System\Twig\SecurityPolicy` to bypass the standard method

How the CVE works: A Server-Side Request Forgery (SSRF) vulnerability in Kyverno allows authenticated users to induce the admission controller

How the mentioned CVE works (around 20 lines): The vulnerability resides in the UDR service’s PUT endpoint /nudr-dr/v2/policy-data/subs-to-notify/{subsId}. The handler

How the mentioned CVE works: The vulnerability exists in the Perforce::generateP4Command() method within Composer’s VCS handling code. This method builds

How CVE-2026-24907 Works October CMS versions prior to 3.7.14 and 4.1.10 contain a stored XSS flaw. The issue exists in

The vulnerability resides in Composer’s Perforce VCS driver. Two methods, Perforce::syncCodeBase() and Perforce::generateP4Command(), construct shell commands without proper escaping. The

The vulnerability exists in ImageMagick’s JXL (JPEG XL) encoder when a user explicitly requests the image to be encoded as

How the mentioned vulnerabilities work (around 20 lines): Policy reuse and mutation: Mutating nested sanitization policy internals (e.g., DEFAULT_POLICY) leaves

The CVE-2026-33902 vulnerability is a stack overflow in the FX expression parser of ImageMagick versions below 7.1.2-19 and 6.9.13-44. The

How the mentioned CVE works The vulnerability resides in the `follow-redirects` package (used by axios) when handling cross-domain HTTP redirects

How CVE-2026-22039 Works The vulnerability resides in Kyverno’s `APICall` feature, which allows policies to fetch external data via HTTP. Attackers

How the mentioned CVE works: The vulnerability resides in gdown/extractall.py within the extractall() function. This function accepts an archive path

How the vulnerability works (CVE-less, but real maddy 0.9.2 and before): The `auth.ldap` module in maddy constructs LDAP search filters

The vulnerability stems from three compounding flaws in Note Mark’s asset handling and delivery path. First, the asset delivery route

When decompressing GZIP data from a FITS image, Pillow did not limit the amount of data being read, meaning that

The vulnerability is a classic heap-based buffer overflow (CWE-122) that occurs in the `NewXMLTree()` method when ImageMagick parses a crafted

The vulnerability works by exploiting a timing discrepancy in the login endpoint’s authentication logic. When a client sends a POST

How the mentioned CVE works: The Temporal frontend gRPC server processes incoming API calls. It uses an interceptor chain to

The vulnerability arises from an integer overflow when parsing PlayStation TIM image files on 32‑bit systems. In the `ReadTIMImage` function

The GIMP Despeckle plug-in performs an unchecked multiplication of image dimensions: width height img_bpp. On 32‑bit platforms, this product can

The vulnerability is a high-severity remote code execution flaw that exists in the way Microsoft Exchange Server handles certain objects

The vulnerability resides in the way VBE6.dll – a core component of Microsoft Visual Basic for Applications – is loaded

How the mentioned CVE works: The vulnerability is a use-after-free (UAF) flaw in Adobe Acrobat and Reader’s JavaScript engine during

How the mentioned CVE works (technical details): The vulnerability exists in Acrobat Reader’s JavaScript engine when processing specially crafted PDF

The vulnerability (CVE-2024-30090) resides in the Host Process for Windows Tasks (taskhostw.exe). It stems from improper link resolution before file

The vulnerability resides in the Windows Common Log File System (CLFS) driver, a core component that manages transaction logging. Due

The vulnerability arises from an incorrect patch for CVE-2022-25860 in simple-git versions ≤3.28.0. The library allows JavaScript to run native

The vulnerability stems from improper sanitization of metric names and label values in Prometheus web UI components. An attacker who

How the CVE works: The vulnerability exists in Executrix.getCommand() which builds shell commands by substituting temporary file paths into a

How CVE works (technical details) The vulnerability exists in the `RequestMacroChain` message handler of the Nimiq Albatross consensus implementation. An

The vulnerability stems from the v2 template engine located in runtime/template/v2/template.go, which imports Sprig’s `TxtFuncMap()` and intentionally removes dangerous functions

How the mentioned attack works (technical details): The attacker leveraged previously compromised, non-atomically rotated credentials from a February 2026 breach.

How the CVE Works The vulnerability is an XML Entity Expansion (XEE) attack, also known as a “Billion Laughs” attack,

The vulnerability arises in the `next-intl` middleware when `localePrefix: ‘as-needed’` is configured. An attacker crafts a URL containing a scheme-relative

The vulnerability (CVE-2024-53989) exists because goshs enforces per-folder `.goshs` ACL/basic-auth for read operations (directory listings and file serving) but completely

The vulnerability exists in Nimiq’s blockchain implementation (core‑rs‑albatross). Block timestamp validation currently enforces: – `timestamp >= parent.timestamp` for non‑skip blocks.

The vulnerability exists in `phpseclib\Net\SSH2::get_binary_packet()` at lines 3405 and 3410 (master branch). When verifying an SSH packet’s HMAC, the code

The vulnerability resides in the expression parser of the mathjs library, specifically in how it handles dynamically‑determined object attributes. When

The `localLoginHandlers` struct in the Juju API server maintains an in‑memory `map string` named `userTokens` to store discharge tokens after

How the vulnerability works (around 20 lines): The n8n-mcp HTTP server exposed several transport endpoints without any authentication. Endpoints like

The vulnerability resides in DNN’s (formerly DotNetNuke) friends feature. Due to missing ownership validation, an attacker can craft a malicious

How the mentioned CVE works: The vulnerability exists in the SFTP rename command implementation. The function `cmdFile` sanitizes only the

The vulnerability is a stored cross-site scripting (XSS) flaw in DotNetNuke.Core. It allows an attacker to upload a malicious SVG

The attack chains four independent flaws for zero‑to‑RCE. First, default config allows open sign‑up because PAPERCLIP_AUTH_DISABLE_SIGN_UP defaults to false (server/src/config.ts:169‑173)

The CVE arises from an incomplete prototype pollution fix in the vendored lodash `set()` utility inside LangSmith SDK (npm `langsmith`

An attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with

The `gcr` Receiver in Flux notification-controller prior to version 1.8.3 fails to validate the `email` claim of Google OpenID Connect

The vulnerability exists in the `cloudstore.file.upload` action defined in server/actions/action_cloudstore_file_upload.go. This action accepts multipart file uploads without any authentication checks.

How the mentioned CVE works: The vulnerability resides in rembg HTTP server’s handling of the `extras` JSON parameter. Attackers send

The vulnerability works through two incomplete CRLF injection patches. First, the `login()` method concatenates user-supplied `user` and `password` directly into

All new DNN installations (versions 10.0.0 through 10.2.1) are assigned the same hardcoded Host GUID instead of a unique, randomly

How CVE-2026-40242 Works The vulnerability exists in the `/api/templates/fetch` endpoint of Arcane versions prior to 1.17.3. The endpoint accepts a

How CVE-2026-5412 Works The vulnerability exists in the Juju Controller facade. An authenticated attacker with only basic login permissions—who also

How the mentioned CVE works (GHSL-2024-161 SSRF): The `/api/remove` endpoint accepts a `url` query parameter. The server uses aiohttp to

How the CVE works (around 20 lines): The vulnerability exists in unhead’s streaming SSR helpers (createStreamableHead, createBootstrapScript, renderSSRHeadSuspenseChunk). The `streamKey`

How CVE-2026-40301 Works The vulnerability exists in `DOMSanitizer::sanitize()` because the function allows ` ` 8. When an application renders the

How the CVE Works The vulnerability resides in the `/allowlist` command handler, which lacks proper owner-only enforcement when processing cross‑channel

How the Vulnerability Works: This vulnerability arises from Axios’s failure to normalize hostnames before evaluating the `NO_PROXY` environment variable. According

The vulnerability resides in OpenClaw, a user‑controlled local assistant. A specific invocation path – `node.invoke(browser.proxy)` – can mutate persistent browser

The vulnerability stems from a stale closure in the `resolvedAuth` state within OpenClaw’s gateway. When the system processes a configuration

The vulnerability stems from a critical design flaw in the `fetchWithSsrFGuard` function within the OpenClaw gateway. This function is designed

The vulnerability resides in OpenClaw’s shared reply mechanism for `MEDIA:` references. When a user shares a media file via a

The vulnerability resides in the `device.token.rotate` function of OpenClaw versions <= v2026.04.01. Under normal operation, device role-upgrade pairing requires explicit

How CVE Works (approx. 20 lines): The vulnerability resides in MinIO’s S3 Select CSV parsing. The `nextSplit()` function in `internal/s3select/csv/reader.go`

The vulnerability arises from how OpenClaw’s Gateway handles concurrent asynchronous shared‑secret authentication attempts on routes that are Tailscale‑capable. On the

The vulnerability arises because the `fast-jwt` library allows `RegExp` objects (with flags like `/g` or /y) for claim validation parameters

How GHSA-cjw9-ghj4-fwxf works: The vulnerability resides in fast-jwt’s claim validation when `allowedAud` (or allowedIss, allowedSub, allowedJti, allowedNonce) is configured with

How the Mentioned CVE Works OpenClaw versions before the fix on `2026.4.8` suffer from a build‑tool environment injection vulnerability because

Tmds.DBus and Tmds.DBus.Protocol are .NET libraries that facilitate D-Bus communication, enabling IPC between applications. A malicious peer on the same

How the mentioned CVE works: The vulnerability exists because the PUT update endpoint accepts a client-controlled full Transaction object, including

How the CVE Works: The vulnerability resides in the `/terminal/ws` WebSocket endpoint, which completely lacks authentication validation. Unlike other endpoints

CVE-2026-1281 is a critical code injection vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0, including 12.5.1.0, 12.6.0.0,

How the CVE works (technical details): The vulnerability exists in `isRepeatedSingleCharRun()` (analysis.ts line 285). When `buildMergedSegmentation()` processes text from `Intl.Segmenter`

The vulnerability occurs when `league/oauth2-server` generates a `client_credentials` token. By design, the library sets the JWT `sub` (subject) claim to

How the vulnerability works: The `ajax_blackList_post()` method in `UserController.php` (lines 344-362) accepts a `note` POST parameter with only a `required`

The CVE-2020-8131 vulnerability exists in the js-yaml library when the `load()` function parses YAML without a safe schema. By default,

How the CVE Works (Technical Explanation) The vulnerability resides in the `cryptography` library’s handling of non-contiguous Python buffers passed to

How this CVE works: The `execute_code()` function defaults to sandbox_mode=”sandbox”, running user code in a subprocess with a restricted `__builtins__`

The vulnerability is a PATH hijacking flaw affecting the OpenTelemetry Go SDK. The resource detection code in `sdk/resource/host_id.go` executes external

The vulnerability exists in the A2U (Agent-to-User) event stream server component of PraisonAI, which is separate from the gateway server.

How the CVE works: The install guard in ci4ms uses a volatile cache check (cache(‘settings’)) combined with `.env` file existence

How the mentioned CVE works: The vulnerability exists in n8n-mcp versions ≤2.47.3 when deployed in multi-tenant HTTP mode. An attacker

How the mentioned CVE works The Install::index() controller reads POST parameter ‘host’ without validation. This value passes directly to updateEnvSettings()

The create_agent_centric_tools() function returns tools (like acp_create_file) that process file content using template rendering. When user input from agent.start() is

The OTLP HTTP exporters in OpenTelemetry-Go versions prior to 1.43.0 are vulnerable to a memory exhaustion attack because they read

The vulnerability exists in the `mcp-from-openapi` library (versions <=2.1.2) due to unsafe handling of `$ref` pointers in OpenAPI specifications. When

How the CVE works (CRLF injection in [email protected]): The vulnerability arises because `protectWhitespace()` only trims leading spaces but leaves `\r`

How the mentioned CVE works: The Pages module fails to apply the html_purify validation rule to content fields during create

How the mentioned CVE works The vulnerability exists in the `safe_join()` function within the `essential_abilities` extension of AGiXT. This function

The vulnerability exists in TopicSelectorStore where cache keys are built by concatenating topic selector and topic with an underscore: k

The vulnerability arises when OpenFGA is configured to use preshared-key authentication (–authn-method preshared) with the built‑in playground enabled (default state).

How the mentioned CVE works: The vulnerability exists in OpenClaw versions prior to 2026.3.28 within the device pairing module. Specifically,

How the CVE Works (around 20 lines) The vulnerability resides in the Tlon media download handler of openclaw npm package