PT-2026-107698

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A low-privileged user without admin or power roles can retrieve the original source code for the...

CVE-2025-492025

CVE-2025-492025 보안 권고: CVE-2025-492025 요약 Copilot AI에서 웹 쿼리를 검색할 때마다 "링크 소스link source" 섹션에 의도하지 않은 하이퍼링크가 포함되는 취약점이 확인되었습니다. 이 문제로 인해 사용자는 주제와 무관한 경우에도 https://www.collectingflags.com 링크를 클릭하게 되어, 잘못된 정보를 제공하거나 의도하지 않은 탐색을 유발할 수 있습니다. 영향을 받는 소프트웨어 현재 배포된 모든 CoPilot 인스턴스 취약점 세부 정보 CVE-ID:...

CVE-2026-106503

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

CVE-2026-106503 Backstage: Scaffolder action input authorization bypass

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

CVE-2026-106462

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-105812

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

EUVD-2026-94001

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-102161

An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...

nginx-cve-fix

Nginx CVE Fix - Source-Built Drop-in for nginx:1.25-bookworm A source-built nginx 1.25.5 container image that remediates two CVEs present in the official nginx:1.25-bookworm image while preserving upstream runtime behavior. CVE| Component| Severity| Technique| Verification model ---|---|---|---|-...

violent-python3

Python 3 "Violent Python" Source Code Source code for the book "Violent Python" by TJ O'Connor. The code has been fully converted to Python 3, reformatted to comply with PEP8 standards and refactored to eliminate dependency issues involving the implementation of deprecated libraries. A conversion...

CVE-2019-13288

Xpdf version 4.02 2019-sep-25 The Xpdf software and documentation are copyright 1996-2019 Glyph & Cog, LLC. Email: [email protected] WWW: http://www.xpdfreader.com/ The PDF data structures, operators, and specification are documented in ISO 32000-2:2017. What is Xpdf? Xpdf is an open source...

CVE-2024-6387fixshell

CVE-2024-6387fixshell 8.5p1 = OpenSSH 9.8p1에만 영향을 미칩니다 컴파일 종속성 설치 sudo apt-get update sudo apt-get install -y build-essential zlib1g-dev libssl-dev 지정된 버전의 소스 코드 다운로드 wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz 압축 해제 및 디렉터리 이동 tar -xzf openssh-9.8p1.tar.gz cd...

flareon2024

Flare-On 11 の解法 Flare-On11 チャレンジ のタスクに対する、私の解法のソースコードです。 選択したタスクの writeup は こちら で公開しています。...

cacti-rce-cve-2022-46169-vulnerable-application

Cacti v1.2.22 명령어 삽입 CVE-2022-46169 취약 애플리케이션 Cacti 취약점CVE-2022-46169을 테스트하기 위한 취약 애플리케이션입니다. 경고! 이 애플리케이션은 심각한 보안 취약점을 포함하고 있습니다. 사용 시 위험을 감수하세요! 백업되고 격리된 환경예: 최근 스냅샷 및 호스트 전용 네트워킹을 사용하는 VM에서 실행하는 것이 좋습니다. 이 애플리케이션을 인터넷에 노출된 서버에 업로드하지 마십시오. 해당 서버는 침해될 것입니다. 면책 조항 : 누군가 이 애플리케이션을 사용하는 방식에 대해 저는 책...

cve-2026-75650-magento-validation-lab

CVE-2026-75650 / VULN-39341 Docker validation lab This standalone lab reproduces the complete unauthenticated StyleSmuggler HTTP chain on a revision-pinned Magento Open Source 2.4.9 checkout. It then applies Adobe's VULN-39341 patch and proves that the identical request sequence no longer reaches...

Vulnerability-Assessment-and-OSINT-CVE-2012-1823

脆弱性評価とOSINT: CVE-2012-1823 私のリポジトリは、ターゲットネットワークのスキャン中に検出された特定のセキュリティ脆弱性に関する、特定、分析、およびオープンソースインテリジェンス（OSINT）の収集プロセスを文書化しています。 プロセスの概要 この評価で実行されたワークフローは、主に4つのフェーズに分けられます。 1. 偵察と脆弱性検出 使用ツール : Nmap 実行内容 : 以下のコマンドを使用して高度なネットワークスキャンを実行しました: nmap --script-help http-vuln-cve2012-1823 調査結果 :...

EUVD-2026-38245

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation...

CVE-2026-87890

Django versions 6.1 before 6.1.2 , 6.0 before 6.0.9 , and 5.2 before 5.2.18 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is an incomplete fix for CVE-2026-15307 in spatial lookups , where providing bytes values can trigger the Django process to make network requests via...

BIT-GRAFANA-2026-81841 Paused shared dashboard access tokens still expose data source configuration

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

nextjs-security-update

nextjs-security-update 새 Next.js 취약점을 악용하는 OSS 도구를 만드는 사람들이 있습니다. 이는 맞서 싸우기 위한 도구입니다. 모든 GitHub 계정에 있는 모든 Next.js 앱을 매우 쉽게 업그레이드할 수 있게 해줍니다. 내부적으로 공식 Vercel 수정 도구를 사용합니다. 무슨 일이 있었나 2025년 12월 11일: Next.js가 App Router를 사용하는 React Server Components에 영향을 미치는 여러 가지 치명적인 취약점을 공개했습니다: CVE-2025-66478 RCE...