CVE-2025-66034-htb-ctf

CVE-2025-66034-htb-ctf VariaType 可变字体生成器漏洞利用工具 此仓库包含针对 Hack The Box 上 VariaType 机器的专用漏洞利用工具。该漏洞利用利用了 fontTools 库或 Web 应用程序处理 .designspace XML 文件和元数据插值时的漏洞，以实现远程代码执行 RCE 。 📝 描述 该漏洞存在于字体生成过程中。通过构造恶意的 designspace 文件，我们可以将 PHP 反向 shell 载荷注入到字体的元数据中（特别是 字段）。当服务器处理这些文件以生成可变字体时，它会将输出写入用户定义的路径，从而允许我们将 .p...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite 检查点 SQL 注入 CVE-2025-67644 是 langgraph-checkpoint-sqlite 包（属于 LangGraph / LangChain 生态）中的一个 SQL 注入 漏洞（CWE-89）。 攻击者可通过传递给 SqliteSaver 的 list / alist 方法的未经净化的元数据过滤键 注入任意 SQL。 影响 ：可完全绕过过滤器、泄漏所有检查点记录（包括可能敏感的对话状态、线程 ID、元数据），在某些部署场景下还可实现更广泛的数据库访问。 受影响版本 ：|"Sends...

CVE-2026-102095

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

CVE-2026-102095 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

CVE-2026-102095 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

CVE-2026-103437 ReadingLists imported metadata permits JavaScript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-103437

The MediaWiki ReadingLists extension (versions 1.46 and 1.45 ) is vulnerable to a Reflected XSS flaw due to the improper neutralization of Script-Related HTML tags. This issue specifically allows JavaScript URL execution via imported metadata . The impact includes the potential for unauthorized s...

CVE-2026-103437 ReadingLists imported metadata permits JavaScript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

EUVD-2026-90083

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177

CloudTAK is vulnerable to a full-read Server-Side Request Forgery (SSRF) in the ESRI helper family routes (e.g., POST /api/esri) prior to version 13.10.0 . The root cause is a lack of IP/DNS/hostname classification; the api/lib/esri.ts library uses a bare fetch on attacker-controlled URLs without...

CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-13720

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2026-25860

CVE-2026-25860 OpenClinic GA 5.247.01 DICOM 图像上传处理器中的反射型 XSS 如果你想将此 XSS 与 RCE 结合利用，可以阅读： https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce 描述 OpenClinic GA " + obj.getStringTag.StudyDescription.replaceAll"\^"...

OESA-2026-4168 python-jupyterlab security update

JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface. Security Fixes: JupyterLab before 4.5.9...

CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

cve-2023-6019

此存储库没有 README。...

EUVD-2026-89789

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...