exploit

This vulnerability exploits the lack of resource-limiting controls in CoreDNS’s gRPC, HTTPS, and HTTP/3 server implementations. For the gRPC, HTTPS,

The vulnerability is an unsafe JavaScript execution within the `_scroll_to_fragment` method. When a user navigates or when the `pushstate` event

The vulnerability occurs when attacker-controlled input is passed directly to the `ui.navigate.history.push()` or `replace()` functions. These functions are wrappers for

This vulnerability is a DOM-based Cross-Site Scripting (XSS) in NiceGUI’s `ui.sub_pages` component. It stems from unsafe JavaScript execution when handling

The safe_join function in Werkzeug is intended to securely join path segments to prevent directory traversal attacks. However, on Windows

The vulnerability occurs in Bio-Formats versions up to and including 8.3.0, where the loci.formats.Memoizer class handles memoization cache files with

The XXE vulnerability in Bio-Formats arises from insecure XML parsing in the Leica Microsystems metadata component, specifically for XLEF files.

The vulnerability exploits unsafe deserialization of pickle data in Python applications. Pickle allows arbitrary code execution during deserialization via the

The vulnerability exists in the `safePath` and `isPathAllowed` functions of version 3.4.0, which utilize Node.js `path.resolve()` for validation. The `path.resolve()`

How the mentioned CVE works: The vulnerability exists within the `execute_command` function of terminal-controller-mcp version 0.1.7. The function improperly concatenates

The vulnerability (CVE-2026-XXXX) stems from Undertow’s failure to adequately parse and validate the contents of the HTTP `Host` header. Normally,

The vulnerability arises from a soundness issue in the `IterMut` iterator implementation within an affected Rust crate. When `IterMut::next` or

How the CVE Works: The vulnerability exists in the Microsoft Playwright Model Context Protocol (MCP) server. The server fails to

A regression in Preact versions 10.26.5 through 10.28.1 softened its JSON serialization protection. This protection normally prevents Virtual DOM elements

The vulnerability exists in the `lib/input.js` file within the Formatter Handler component. It arises from improper sanitization of user input

The vulnerability is a blind SQL injection in the CoreShop e-commerce platform, specifically in the sales report functionality accessible to

The vulnerability exists within the HTTP middleware’s authentication whitelist logic. It fails to correctly normalize and compare URL paths, allowing

The vulnerability in loggingredactor occurs when the library processes log entries containing non-string data types (like integers, dicts) with format

How the mentioned CVE works: The vulnerability is a Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in

The vulnerability exists in the media proxy endpoint (GET /proxy/{encodedDigest}/{encodedURL}) within internal/ui/proxy.go. When an authenticated user subscribes to a feed

The vulnerability exists in the interaction between urllib3’s streaming API (preload_content=False) and HTTP redirect responses. The library’s design efficiently handles

The vulnerability exists in n8n’s webhook and form trigger nodes. When a workflow is triggered via a public form or

The Stripe Trigger node in n8n creates a webhook endpoint with a stored Stripe signing secret for verification. The vulnerability

This vulnerability stems from pnpm’s handling of dependencies fetched via HTTP/HTTPS tarball URLs and Git-hosted tarballs. When resolving such dependencies,

In pnpm v10+, a security feature was introduced to disable lifecycle scripts (like postinstall) for dependencies by default. This is

The vulnerability exploits the interaction between pnpm’s environment variable substitution in `.npmrc` files and the insecure execution of the tokenHelper.

A vulnerability exists in the gRPC implementation of RustFS where the `GetMetrics` endpoint handler lacks proper deserialization error handling. The

The vulnerability exists within the parsing of the `OutlineTextRefAtom` record in PowerPoint (PPT) files. This atom stores a reference index

The remote code execution vulnerability in HPE OneView stems from improper deserialization of untrusted data within its web management interface.

The vulnerability exists in the `/rustfs/rpc/read_file_stream` endpoint. The handler in `crates/ecstore/src/disk/local.rs:1791` uses `PathBuf::join()` to concatenate a user-controlled `path` parameter onto

This vulnerability resides within the Quarkus RESTEasy Reactive (or REST) HTTP layer’s response writing mechanism. When the framework sends a

The vulnerability exists within the `UriTemplate` class’s URI matching logic when processing RFC 6570 exploded array patterns (e.g., {/list}). The

The open redirect vulnerability in Directus arises from insufficient validation within the SAML 2.0 authentication flow. Specifically, the `RelayState` parameter,

The vulnerability exists within the `crypto/rsa` library’s `NewPrivateKey` function. When constructing an RSA private key from its raw components (the

The vulnerability (CVE-2026-XXXXX) is an authenticated Remote Code Execution flaw stemming from an arbitrary file write primitive. An attacker with

The CVE-2023-3936 vulnerability in Kyverno stems from incorrect priority handling when multiple PolicyExceptions exist for a single enforced ClusterPolicy. Kyverno

The vulnerability exists within the `parsl.monitoring.visualization.views.py` module of the Parsl library. User-supplied `workflow_id` parameters are taken directly from URL routes

The vulnerability resides in the `match_host` function within src/bokeh/server/util.py. This function is responsible for validating incoming hostnames against a configured

The vulnerability exists in the `/proxy` endpoint of Mailpit. This endpoint is designed to fetch external resources but improperly validates

This vulnerability exists in the MONAI framework’s `_download_from_ngc_private()` function. When downloading and extracting a bundle from a private NVIDIA NGC

The vulnerability in Pterodactyl arises from the Wings daemon’s handling of SFTP connections for server file access. When a user

The vulnerability in evershop 2.1.0 and prior is a blind Server-Side Request Forgery (SSRF) in the “GET /images” API endpoint.

The vulnerability exists in the Java Naming and Directory Interface (JNDI) lookup feature of Apache Log4j versions 2.0-beta9 through 2.14.1.

This vulnerability resides in the HTTP Range header parser within the aiohttp library. The component uses a regular expression designed

This CVE affects the `aiohttp` web framework when Python is run with optimizations enabled (-O or PYTHONOPTIMIZE=1). In this mode,

The vulnerability in AIOHTTP allows for denial of service through memory exhaustion when handling large payloads. It specifically affects servers

How the CVE Works CVE-2024-23334 exploits aiohttp’s request body decompression. The server automatically decompresses HTTP requests with Content-Encoding: deflate/gzip. A

This vulnerability operates within the `aiohttp.web` framework’s HTTP cookie parsing mechanism. When a client sends an HTTP request with a

The vulnerability exists within Vega’s internal `modify()` expression function, which is accessible through user-controlled specifications, notably via the `setdata` operation.

How the Mentioned CVE Works The vulnerability exploits the chunked transfer encoding mechanism in the aiohttp web server. Normally, this

The vulnerability in AIOHTTP’s static file serving via `web.static()` involves path normalization designed to prevent directory traversal. However, this normalization

The vulnerability operates through Spinnaker’s artifact providers that accept user-supplied URLs for data retrieval. When enabled, such as HTTP artifact

The vulnerability resides in the `vlSelectionTuples` function. Vega’s expression evaluator normally restricts arbitrary function calls. However, when an event object

The vulnerability is a path traversal bypass in the Apache Kyuubi Server’s file access controls. The server uses a configuration

The vulnerability exploits the Backup addon’s file export functionality in REDAXO. Authenticated users with backup permissions can manipulate the EXPDIR

The vulnerability exists in the ERC7984ERC20Wrapper contract which implements a confidential token wrapper. It uses an internal `_mint` function that

The vulnerability exists within the `Action` class where caption properties accept raw HTML by default without proper output encoding or

How the Mentioned CVE Works The vulnerability exists within the `gix_date::parse::TimeBuf` struct in the Rust `gix-date` crate. The `TimeBuf::as_str()` method

The vulnerability in badkeys arises from insufficient input sanitization when processing malformed data containing ASCII control characters such as vertical

This vulnerability exploits the nonce-based encoder selection logic in the Sliver C2 server. When an unauthenticated HTTP request contains a

This vulnerability exploits the Yii framework’s behavior attachment mechanism within Craft CMS. Attackers with administrator access can send crafted JSON

The vulnerability in CraftCMS arises from admin controllers explicitly permitting anonymous access to critical methods. In AppController.php, the $allowAnonymous property

This vulnerability, tracked in the GitHub Advisory Database, enables authenticated Remote Code Execution (RCE) in Craft CMS via Server-Side Template

The vulnerability exists within the `save__Asset` GraphQL mutation. The mutation accepts a `_file` input object containing a `url` parameter. When

The vulnerability exists in the node.js-specific builds of the jsPDF library (dist/jspdf.node.js and dist/jspdf.node.min.js). It stems from insufficient sanitization of

The vulnerability in Craft CMS involves an information disclosure issue due to unchecked asset relocation during user profile photo updates.

How CVE-2025-47907 Works The vulnerability exists in the `database/sql` package’s `(Rows).Scan` method. When a database query is executed concurrently and

The vulnerability exploits the EXT32 data type in the MessagePack serialization format. An attacker creates a small, syntactically valid .msgpack

How the mentioned CVE works This stored Cross-Site Scripting (XSS) vulnerability exists in the campaign and template management components. An

This Insecure Direct Object Reference (IDOR) vulnerability exists within the `reorder()` method of the `OrderController.php` controller. The function is accessible

How the mentioned CVE works: The vulnerability exists in customer profile update functionality. When a low-privileged user submits a crafted

The vulnerability is a Server-Side Template Injection (SSTI) in the Bagisto e-commerce platform, built on Laravel with the Blade templating

The vulnerability is a Server-Side Template Injection (SSTI) in the Bagisto e-commerce platform, specifically in the “type” parameter of the

How the mentioned CVE works: The vulnerability exists within the Ib platform’s installation module (Ibkul/Installer). The installation process defines API

The vulnerability is caused by missing authentication decorators in three FastAPI endpoints within monitor.py. The `dependencies=[Depends(get_current_active_user)]` parameter is absent from

The vulnerability is a reflected cross-site scripting (XSS) issue in go-httpbin version 2.17.1, caused by unrestricted client control over the

The vulnerability exists within the `MultipartFile.move()` method of the AdonisJS BodyParser. When handling file uploads, the method uses the client-supplied

The vulnerability in Apache StreamPipes involves improper privilege management within the user ID creation mechanism, allowing non-administrator users to escalate

The vulnerability operates as a side-channel information disclosure flaw within the `/api/v1/user` endpoint’s authentication logic. When an unauthenticated or incorrectly

The vulnerability in Feast version 0.53.0 involves insecure YAML deserialization in the Kubernetes materializer job. In the file feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py, the

This vulnerability exists due to flawed authorization logic when the Temporal server configuration has `system.enableCrossNamespaceCommands` enabled (default state). The frontend

The SignalK appstore interface’s `/appstore/install/:name/:version` REST API endpoint allows admin users to install npm packages. While it validates the package

The vulnerability exists in the SignalK Server’s access request endpoint (/signalk/v1/access/requests). This endpoint accepts unauthenticated POST requests by design for

This vulnerability exists because the SignalK server’s authentication middleware, configured in src/tokensecurity.js, does not protect several sensitive API endpoints. The

How the Mentioned Vulnerability Works The vulnerability exploits two flaws in SignalK’s access request system. First, the administrative interface prominently

The vulnerability exploits two chained flaws. First, an unauthenticated attacker connects a WebSocket to the `/signalk/v1/stream` endpoint with ?serverevents=all. The

The vulnerability occurs in Temporal server when the configuration setting `frontend.enableExecuteMultiOperation` is enabled. This feature allows clients to execute multiple

The Trix editor, in versions prior to 2.1.16, is vulnerable to stored cross-site scripting (XSS) attacks through the data-trix-attachment attribute.

The vulnerability resides in the improper state management of the `shareables` list within the `cbor2` library’s CBORDecoder. When a decoder

The CVE-2023-38151 vulnerability in the Visual Studio Code Go extension arises from improper handling of untrusted projects when Restricted Mode

The vulnerability exists within the experimental MCP server feature (serverless mcp). The `list-projects` tool accepts a user-controlled `workspaceRoots` parameter. This

How the mentioned CVE works: The vulnerable application loads user-defined Python rules and configuration files from locations like ~/.config/theshit/. When

This vulnerability occurs due to insufficient cycle detection when parsing MVG (Magick Vector Graphics) files. When ImageMagick processes an MVG

The vulnerability occurs within the `SVGStartElement` function in ImageMagick’s SVG coder. When parsing a maliciously crafted SVG file containing a

The CVE-2025-008 vulnerability in RustFS stems from a static, hardcoded authentication token “rustfs rpc” used for gRPC service access. This

The qs library, a Node.js query string parser, includes an arrayLimit option designed to prevent denial-of-service by restricting array sizes

The vulnerability is a bypass of a previous fix for credential leakage in the Ruby URI gem. When the `+`

This vulnerability functions through the product file upload feature. An authenticated attacker can upload a specially crafted XML file. This

The vulnerability, CVE-2024-34070, is a classic Zip Slip attack vector within the PsiTransfer application. It originates in the archive creation

The vulnerability involves the injection of ANSI escape sequences into the terminal output of Composer commands. ANSI sequences are control