CVE-2023-27372-PoC

このPoCはすぐに書かれたもので、特別なものではありません。 これは新しいCVE-2023-27372 SPIP RCE脆弱性を悪用します。 これは、パスワードリセット機能（spip.php?page=spippass）内でENVタグの危険な使用を悪用する逆シリアル化の欠陥であり、"/ecrire/balise/formulaire.php"の特に以下の行です： 1. 構文: python3 exploit.py -u https://url.com root@kitploit: function protegechamp$texte if isarray$texte $texte =...

CVE-2026-24061

🚨 CVE-2026-24061 —「TelneTD」 GNU Inetutils telnetdにおける重大なリモート認証バイパス 2015年の亡霊が、まだtelnetを動かしている全てを乗っ取るために舞い戻った。 認証不要。環境変数一つ。即座にルートシェル。 ⚠️ 概要 CVE-2026-24061 は、GNU Inetutils telnetd ≤ 2.7 における重大なリモート特権昇格 脆弱性です。 認証されていないリモート攻撃者が、Telnet NEW-ENVIRONオプションを介してUSER環境変数を"-f root"に設定します。 telnetdはそれをサニタイズせず...

CVE-2022-36162

CVE-2022-36162 推奨される説明 pdftoroff hovacui 1.1.0 は、コマンド実行の影響を受けます。影響は、任意のコードを実行することです （ローカル）。コンポーネントは hovacui.c の 1574 行目です。攻撃ベクトルは次のとおりです。 この脆弱性を悪用するには、HOME 環境変数を変更し、postsave として何らかのコマンドを設定し、 PDF ファイルを開いて保存するだけです。hovacui には、任意のコマンド実行を可能にする脆弱性が 見つかりました。1574 行目: 1574 systemcommand; 環境変数 HOME...

shellshock

shellshock BourneシェルのEVN関数解析の脆弱性CVE-2014-6271に関連するスクリプト dhcpmon.py - このスクリプトは、BOOTPおよびDHCP応答フィールド内の潜在的に悪意のある文字を監視します。...

GHSA-W34Q-CM8F-9C5X OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get...

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get...

GHSA-HPJ9-GRJP-7VC7 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

EUVD-2026-81291

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

RHCOS 4 : OpenShift Container Platform 4.12.98 (RHSA-2026:65906)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65906 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

CVE-2026-92591

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-92591 Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-92591

Craft CMS versions 5.0.0 through 5.10.12 misinterpret a database connection failure as the application being uninstalled, exposing anonymous installer actions (e.g., install/validate-site) on a production site. The installer's site-name field is serialized through Site::getName(), which expands $...

Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

EUVD-2026-77758

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...