exploit

How the CVE Works: This vulnerability arises in NestJS applications utilizing the `@nestjs/platform-fastify` adapter when security middleware (e.g., for authentication)

The vulnerability occurs in server-side applications using the `axios-cache-interceptor` library to proxy requests to an upstream service. The flaw is

How the mentioned cve works: The vulnerability in Picklescan arises from its reliance on _operator.attrgetter, a built-in Python function, to

The vulnerability exploits a missing authentication check in the `SetupController.php` file’s `backup()` method. A default `.htaccess` rewrite rule makes the

How the CVE Works This vulnerability is a bypass of the Picklescan security scanner. Picklescan works by analyzing pickle files

The vulnerability in Picklescan arises from its failure to detect a malicious pickle file that leverages the `numpy.f2py.crackfortran._eval_length` function as

The vulnerability exploits the `picklescan` security scanner’s failure to detect the dangerous `_operator.methodcaller` function within malicious pickle payloads. Attackers craft

How the mentioned CVE works (around 20 lines): The vulnerability exploits a gap in the Picklescan security tool’s detection capabilities.

How the mentioned CVE works: The vulnerability stems from improper handling of user-supplied HTML entities in the display_name field during

The vulnerability resides in the `isPublicUrl` function which validates webhook URLs. It uses a blocklist of regex patterns to match

The vulnerability exists in actiontech sqle versions up to 4.2511.0 within the JWT Secret Handler component, specifically in an unknown

The vulnerability exploits the `numpy.f2py.crackfortran.myeval` function, which is used in NumPy for evaluating Python expressions from strings. In Python’s pickle

The vulnerability resides in the handling of compressed protocol messages. When a client sends a Zlib-compressed message, it includes a

This vulnerability exploits a gap in Picklescan’s default dangerous function blocklist. Picklescan is a security tool designed to scan pickle

This vulnerability is a bypass in the Picklescan security scanner where it fails to recognize the `ctypes` module as dangerous

This vulnerability exploits a gap in PickleScan’s security checks by utilizing the `pty.spawn` function, which is absent from its list

The vulnerability stems from unsafe code execution within the `numpy.f2py.crackfortran` module. Functions such as `getlincoef` and `_eval_length` use Python’s `eval()`

The vulnerability exploits an insufficient denylist within the Picklescanner security tool. The scanner is configured to block specific dangerous functions

The path traversal vulnerability in Croogo CMS 4.0.7 operates through the ‘edit-file’ parameter in certain application endpoints. Attackers can craft

This vulnerability is a DNS rebinding attack against the MCP Python SDK (mcp on PyPI). In versions before 1.23.0, HTTP-based

The vulnerability in Gitea prior to version 1.22.2 arises from improper propagation of token scopes within its internal package registry

The vulnerability in Gitea before version 1.21.2 stems from an access control bypass in the authentication middleware for private user

How the mentioned CVE works: In Gitea before version 1.20.1, a cross-site scripting vulnerability exists due to inadequate validation of

The vulnerability in libxmljs version 1.0.11 arises from improper handling of internal properties when parsing specially crafted XML documents. Specifically,

How the mentioned CVE works: The vulnerability in Gitea before version 1.22.2 enables Cross-Site Scripting (XSS) attacks via the search

The vulnerability in Gitea versions prior to 1.21.8 allows unauthorized disclosure of user login timestamps through the web interface. This

In Gitea before version 1.22.5, the system fails to properly enforce branch deletion permissions after merging a pull request. Normally,

The `reciprocal_mg10` function in the `ruint` crate is publicly marked as safe, implying it cannot trigger undefined behavior (UB). However,

This vulnerability in Gitea versions prior to 1.22.3 stems from improper authorization checks when processing API requests with tokens scoped

The vulnerability resides in the authorization logic for the `/repos/{owner}/{repo}/releases/{id}` API endpoint responsible for deleting releases. Gitea’s permission model is

This vulnerability exists in the Mattermost server’s handling of post action integrations, specifically the `/share-issue-publicly` slash command intended for the

The vulnerability exists in the integration between Mattermost and Jira. When an authenticated user requests to attach a Mattermost post

This vulnerability operates in self-hosted n8n instances where the Code node is configured to run in legacy JavaScript execution mode,

How the mentioned vulnerability works: The sandbox bypass vulnerability in n8n’s Python Code Node arises from the integration of Pyodide,

The vulnerability (CWE-502) exploits how `torch.load()` uses Python’s `pickle` module by default. When `weights_only=True` is not set, `pickle` reconstructs objects

The vulnerability exploits the “Respond to Webhook” node in n8n workflows. When configured to return HTML content, this node can

How the CVE Works The vulnerability existed in the `Serializable.toJSON()` method. When LangChain serializes objects (e.g., for storage or transmission),

How the Mentioned CVE Works: The vulnerability (GHSA-hm5p-x4rq-38w4) is a logic flaw in the HTTP client library `httparty` for Ruby.

This vulnerability exists in the administrative file upload functionality of Cadmium CMS version 0.4.9. The endpoint `/admin/content/filemanager/uploads` does not implement

How the mentioned CVE works: The vulnerability is a stored Cross-Site Scripting (XSS) in the LibreNMS Alert Rule API. When

The vulnerability exists within the Downloader integration. When processing a user-supplied download request, the application constructs a final file path

How the CVE Works: The vulnerability exists within the Page Settings module of Piranha CMS version 12.1. The ‘Excerpt’ input

The vulnerability exists within the Media module of Piranha CMS. When a user, typically with content editor permissions, uploads or

The vulnerability in Umbraco CMS v16.3.3 arises from inadequate validation mechanisms during file upload processes, specifically targeting PDF files. Attackers

The vulnerability is in the `docloader.ts` file. A regex pattern used to parse HTML “ and “ tags contains nested

The vulnerability exists in the `Schema.load(data, many=True)` method. When deserializing a list of nested objects, the library’s logic for handling

How the Vulnerability Works: The vulnerability resides within KEDA’s TriggerAuthentication resource when configured for HashiCorp Vault authentication. Specifically, the `spec.hashiCorpVault.credential.serviceAccount`

How the mentioned CVE works: The vulnerability resides in the `time_tzsetup.cgi` CGI script on the Digiever device’s web interface. This

The vulnerability resides in n8n’s workflow expression evaluation system, where user-supplied expressions during workflow configuration are processed. Authenticated users can

The vulnerability operates within Cowrie’s default emulated shell mode, where it mimics common Linux commands for honeypot functionality. Commands like

The vulnerability exists in multiple API endpoints designed for user file access. These endpoints use a Universally Unique Identifier (UUID)

The vulnerability in Elasticsearch Packetbeat stems from improper resource management during IPv4 fragment reassembly. Packetbeat, a network packet analyzer, processes

How the CVE Works The vulnerability exists in an API endpoint designed to serve user-uploaded files, which are referenced by

The vulnerability exists in the `/api/v1/flows/` POST endpoint. An authenticated client can include an `fs_path` field in the request body.

The vulnerability resides in the snapshot restore functionality of Elasticsearch. An authenticated user with the specific privilege to restore snapshots

The vulnerability in Orejime arises from its processing of HTML data attributes during user consent actions. Orejime, a consent management

The vulnerability exists in the `get_oauth_router` function of FastAPI-Users. During OAuth authorization (/authorize), the `authorize` endpoint creates a JWT state

The vulnerability in fastapi-sso arises from improper handling of the OAuth state parameter during the authentication callback. The `get_login_url` method

The vulnerability exists in how Tutanota processes contact data within the Mithril.js framework. User-controlled input from imported contact fields is

An authenticated Keycloak realm administrator can configure an LDAP User Federation provider with a malicious LDAP server URL. The vulnerability

How the mentioned vulnerability works: The vulnerability exists in the Socket Appender component of Apache Log4j Core. Affected versions range

This vulnerability in Elasticsearch arises from improper resource allocation limits in the user settings data handling mechanism. Elasticsearch provides API

The vulnerability exists due to improper validation of calculated offsets within the Syslog input parser and the Dissect processor in

The GetAsanaObject Processor in Apache NiFi utilizes a Distribute Map Cache Client Service for state management. It employs generic Java

This critical vulnerability (CVE-2024-5997) resides in the IKEv2 implementation of WatchGuard Fireware OS for both Mobile User and Branch Office

This vulnerability exploits a race condition and insufficient symlink validation in Git during local clone operations with submodules. When cloning

This vulnerability, CVE-2025-53024, allows an authenticated attacker with commit privileges to read arbitrary files on the Weblate server’s filesystem. The

The vulnerability in Biopython’s Bio.Entrez module through version 1.86 involves improper handling of XML external entities (XXE) during XML parsing.

When the `nbconvert` tool converts a notebook containing SVG output to a PDF on Windows, it must find the Inkscape

The vulnerability is a missing key commitment flaw in the S3 Encryption Client for PHP. When the library’s `InstructionFileMetadataStrategy` is

The vulnerability arises from the lack of key commitment in the S3 Encryption Client (S3EC) for Go when using the

The vulnerability stems from a missing cryptographic “key commitment” mechanism in the S3 Encryption Client for Ruby when using the

The vulnerability exists in Storybook’s build-time processing of environment variables from `.env` files (e.g., .env.local). When `storybook build` is executed

The vulnerability arises because tinacms utilizes the gray-matter npm package to parse front matter in markdown files without overriding its

This vulnerability is a cryptographic key commitment flaw in the AWS S3 Encryption Client for Java, known as an “Invisible

How the mentioned CVE works: The AWS S3 Encryption Client for .NET (S3EC) facilitates client-side encryption for data stored in

How the mentioned CVE works: The vulnerability resides in the `jwe.decrypt` function of python-jose version 3.3.0. It involves the processing

The Insecure Direct Object Reference (IDOR) vulnerability in Pagekit CMS v1.0.18 resides within the User Role component, allowing unauthorized privilege

The vulnerability in Pagekit CMS v1.0.18 involves an authenticated arbitrary file upload in the /storage/poc.php component. Attackers with valid user

The vulnerability in jose4j before version 0.9.5 involves a denial-of-service attack through crafted JSON Web Encryption (JWE) tokens. JWE tokens

The vulnerability in Mattermost arises from insufficient validation of redirect URLs on the /error page in affected versions. When an

How the CVE Works The vulnerability exists in the Model Context Protocol (MCP) server for Git. When the server is

The vulnerability exists within the Mattermost GitHub plugin’s reaction forwarding feature. When a user adds an emoji reaction to a

The vulnerability exists in the Apache Airflow Providers Edge3 package versions prior to 2.0.0 when installed on an Airflow 2.x

This vulnerability, as indicated by its CVSS 3.1 score of 10.0, represents a critical threat vector within affected Cisco systems.

The vulnerability, CVE-2024-56789, stems from a logic flaw within the Auth0-PHP SDK’s token verification routine. When a Symfony application configured

The vulnerability arises from flawed audience claim validation in the Auth0-PHP SDK’s JWT token verification process. Access tokens and ID

How the Mentioned CVE Works The vulnerability, CVE-2024-XXXXX, stems from a flaw in the Auth0-PHP SDK’s token validation logic. The

How the Mentioned Vulnerability Works This was a sophisticated supply chain attack against the ASUS Live Update software distribution mechanism.

How the mentioned CVE works: A reserved CVE is allocated by a CVE Numbering Authority (CNA) for a vulnerability before

How the mentioned CVE works: The vulnerability stems from flawed audience validation in the Auth0-PHP SDK integrated into the Auth0

The vulnerability in mcp-server-git‘s `git_init` tool functioned as a path traversal and authorization bypass. Unlike other tools in the server

This vulnerability exploits Grav’s page editing interface, which insufficiently sanitizes user input in content fields. An authenticated user, even with

CVE-2025-43463 is a security vulnerability in Apple macOS caused by a parsing flaw in the handling of directory paths. The

How the CVE Works Apache StreamPark versions 2.0.0 to 2.1.6 use the user’s plaintext password as the HMAC signing key

The vulnerability is a stored Cross-Site Scripting (XSS) flaw within the Frappe LMS Job Form. In versions prior to 2.42.0,

The vulnerability exists because the device’s web interface uses HTTP Basic Authentication over unencrypted HTTP connections. When an administrator logs

The vulnerability is a heap-based buffer overflow (CWE-122) in the Pepper language compiler, version 0.1.1. The flaw exists within the

How the Mentioned CVE Works The vulnerability CVE-2025-43437 is an information disclosure weakness within the “Find My” component of Apple’s

The CVE-2025-6599 vulnerability is an uncontrolled resource consumption flaw in the HTTP web server of the Zyxel DX3301-T0 routers. It