2832 matches found
AZL-105675 CVE-2026-102925 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
CVE-2026-102925
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
CVE-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
CVE-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
CVE-2025-55319-PoC
Reference: CVE-2025-55319 针对 HTB "Checkpoint" 挑战的 VS Code .vsix 扩展概念验证。 安装后，扩展自动激活并产生一个隐藏的 PowerShell 反向 shell 回连到攻击者。 ⚠️ 仅限授权使用。 这是一个 CTF/实验室环境产物。仅可部署在你拥有或明确授权测试（例如 HTB 目标机）的机器上。 工作原理 extension/package.json — 扩展清单。"activationEvents": "" 使它在 VS Code 加载时即刻运行，无需用户交互。 extension/extension.js — 在...
Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs Via Weight Orthogonalisation
Backdoor attacks can be implanted in Large Language Models LLMs during training, causing unwanted behaviour when a trigger appears in the input. Existing backdoor defences for LLMs attempt to remove the backdoor but inadvertently shift the model's output distribution to benign prompts, which can...
CVE-2026-23111
CVE-2026-23111 PoC Linuxカーネル nftablesのUse-After-Free（ローカル権限昇格） poc by baba01hacker 脆弱性の概要 CVE : CVE-2026-23111 タイプ : Use-After-Free CWE-416 CVSS : 7.8 HIGH コンポーネント : net/netfilter/nftablesapi.c — nftmapcatchallactivate 根本原因 : 反転したgenmaskチェックにより、トランザクションアボート中にチェーン参照カウンタがリークする 影響を受けるカーネルバージョン...
CVE-2026-97027
Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry .desktop and D-Bus Service .service files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service e.g. forced application restart...
CVE-2025-65320
CVE-2025-65320 标题 Abacre Restaurant Point of Sale POS 进程内存中以明文形式存储敏感许可材料 概览 在 Abacre Restaurant Point of Sale POS 版本 = 15.0.0.1656 中存在一个漏洞，其中敏感许可数据在软件激活工作流期间以进程内存中的明文形式 存储。 在许可证激活过程中，应用程序生成并处理设备绑定的许可证密钥 ，这些密钥旨在针对特定机器验证软件安装。然而，这些值在没有适当保护或安全内存处理机制的情况下分配到进程内存中。 因为这些值以明文形式...
CVE-2023-30486
CVE-2023-30486 Square = 2.0.0 - activatepluginを介した認可の欠落 説明 WordPress向けSquareテーマは、バージョン2.0.0以下において、AJAXアクションを介して呼び出されるactivateplugin関数に対するcapabilityチェックが欠如しているため、無許可のプラグインアクティベーションに対して脆弱です。これにより、サブスクライバーレベル以上のアクセス権を持つ認証済み攻撃者が任意のプラグインをアクティベートできる可能性があります。 Missing Authorization CVSS Vector...
CVE-2026-100593
OpenClaw npm package openclaw before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond mor...
CVE-2026-100593
The OpenClaw npm package (openclaw) versions prior to 2026.7.1 fail to enforce an owner-only requirement for persistent /activation policy changes in group channels. This allows an authorized non-owner channel sender to modify whether the agent requires mention-based activation. Consequently, the...
EUVD-2026-87458
OpenClaw npm package openclaw before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond mor...
CVE-2026-100593 OpenClaw before 2026.7.1 Authentication Bypass via activation
OpenClaw npm package openclaw before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond mor...
CVE-2026-100593 OpenClaw before 2026.7.1 Authentication Bypass via activation
OpenClaw npm package openclaw before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond mor...
CVE-2026-100593 OpenClaw before 2026.7.1 Authentication Bypass via activation
OpenClaw npm package openclaw before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond mor...
CVE-2026-100593: Missing Authorization
OpenClaw npm package openclaw before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond mor...
PT-2026-99229
Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.7.1 Description The software fails to enforce the owner-only requirement for persistent policy changes via the /activation endpoint in group channels. This allows an authorized sender who is not the owner to...
CVE-2026-95699 MrSteam iSteamX Improper Isolation or Compartmentalization
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...
GHSA-Q4C5-2J6F-R476 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...