EUVD-2026-87985

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.calltool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal...

CVE-2026-101060

Versions of python-utcp before 1.1.4 are vulnerable to a Server-Side Request Forgery (SSRF) in the HttpCommunicationProtocol.call_tool function. The root cause is that the application validates the initial tool URL but fails to re-validate the target during HTTP redirects . An attacker controllin...

CVE-2026-101045 Fleet Homebrew Cask OS Command Injection via Metadata

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters for exampl...

CVE-2024-53677-Analysis

Анализ CVE-2024-53677 Этот репозиторий содержит документацию и лабораторные артефакты, подготовленные для анализа CVE-2024-53677 в Apache Struts. Обзор CVE-2024-53677 — это уязвимость в обработке загрузки файлов Apache Struts. Проблема возникает, когда метаданные, связанные с именем файла из...

CVE-2025-31324

CVE-2025-31324 PoC, разработанный для эксплуатации CVE-2025-31324. Использование usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help message a...

steg-tools

steg-tools 이 목록은 스테가노그래피와 정보 은닉을 배우고 실험하기 위한 도구 및 리소스 모음입니다. 도구 Exiftool은 EXIF, GPS, XMP, ID3를 포함한 다양한 파일의 메타데이터를 조작하기 위한 Perl 라이브러리이자 명령줄 응용 프로그램입니다. Strings는 binutils의 일부이며, 많은 Unix OS에 사전 설치되어 있습니다. macOS에서는 Xcode 명령줄 도구의 일부이며 xcode-select --install로 설치할 수 있습니다. Strings는 바이너리 및 기타 파일에서 출력 가능한...

Pixel-Flood-Attack

Pixel Flood DoS - CVE-2024-22393 PoC Pixel Flood баг для веб-серверов Легковесное Proof-of-Concept для тестирования уязвимости исчерпания памяти Pixel Flood в веб-приложениях, работающих на уязвимых версиях Apache Answer. Содержание Описание Технические детали Уязвимые версии Требования...

Burp_CVE-2025-31324

Расширение Burp Suite для CVE-2025-31324 Обзор Это расширение Burp Suite на Python предназначено для обнаружения CVE-2025-31324 — критической уязвимости в компоненте Metadata Uploader SAP NetWeaver Visual Composer. Уязвимость позволяет неавторизованному удаленному выполнению кода через загрузку...

StegoLab

🕵️ StegoLab – 올인원 이미지 스테가노그래피 툴킷 StegoLab 은 CTF, 사이버 보안 챌린지, 디지털 포렌식 을 위해 제작된 경량 올인원 이미지 스테가노그래피 분석 제품군 입니다. binwalk, steghide, stegseek, zsteg, exiftool 등 널리 사용되는 도구들을 단일 대화형 인터페이스에서 자동으로 실행합니다. ✨ 주요 기능 🔍 메타데이터 추출 EXIF, XMP, IPTC, ICC 🧩 숨겨진 데이터 탐지: LSB 카빙, 문자열 검색, zsteg 🛠 도구 자동 래핑: binwalk,...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the ConfigWriter::cleanUpString process. An attacker can execute arbitrary shell commands by injecting specially crafted Liquidsoap string interpolation sequences into playlist URLs or station metadata field...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Liquidsoap API endpoint due to missing internal connection requirements and improper validation of the AutoDJ flag. An attacker can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclo...

CVE-2026-100863

Heym versions 0.0.90 and earlier contain two server-side request forgery SSRF egress gaps, both remediated in app/services/ssrfguard.py in 0.0.91. First, the LLM image-edit input loader loadimagebytes fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check an...

CVE-2026-100854

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

CVE-2026-100842

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

CVE-2026-100861 heym before 0.0.105 SSRF via credential-controlled base URLs

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...

CVE-2026-100861 heym before 0.0.105 SSRF via credential-controlled base URLs

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...

CVE-2026-100854

AzuraCast versions before 0.23.6 are vulnerable to a metadata injection flaw via the Liquidsoap API . The root cause is the missing RequireInternalConnection middleware on the API endpoint and the incorrect derivation of the AutoDJ flag from header presence instead of a validated value. An attack...

CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

EUVD-2026-87834

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...