CVE-2026-93518

A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension XKB, the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially...

CVE-2026-93517

A flaw was found in xorg-x11-server. The GLX OpenGL Extension to the X Window System interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially...

CVE-2024-45337

CVE-2024-45337 の概念実証エクスプロイト このリポジトリには、CVE-2024-45337 の概念実証エクスプロイトが含まれています。 これは、golang.org/x/crypto = v0.30.0 を使用して実装され、ServerConfig.PublicKeyCallback コールバック内で権限を安全でない方法でキャッシュしている SSH サーバーとやり取りする際に、ssh をラップするために使用できます。 Gitea = 1.22.4 および Forgejo = 7.0.11、9.0.2 は、内部 SSH...

NextJS-app-CVE-2025-55182

Next.js CVE-2025-55182 概念実証 これは、React Server Componentsにおける深刻なリモートコード実行（RCE）脆弱性である CVE-2025-55182 （別名「React2Shell」）に対して脆弱なNext.jsアプリケーションの概念実証です。 ⚠️ 警告 このアプリケーションは意図的に脆弱性を持っており、以下の目的にのみ使用すべきです： セキュリティ研究 教育目的 隔離環境でのテスト 禁止事項： 本番環境へのデプロイ 信頼できないネットワークへの公開 機密データとの併用 脆弱性の詳細 CVE-2025-55182 は以下に影響します：...

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...

ish

iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...

CVE-2026-107272

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107206

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

DEBIAN-CVE-2026-106574

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

CVE-2026-106574

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

DEBIAN-CVE-2026-106570

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...

CVE-2026-106570

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty ar...

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server vulnerability discovered by ? in WordPress Npm quasar versions = 2.23.2...

EUVD-2026-94521

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2021-4773

CVE-2021-4773 これは、仮想マシンを使用して脆弱性CVE-2021-4773を悪用する方法の練習例です。 このチュートリアルには以下が必要です。 Kali Linux の仮想マシン Ubuntu Server の仮想マシン Apache バージョン 2.4.49 のインストール それでは始めましょう。 2台の仮想マシンが実行されている状態で、アーカイブリポジトリからApacheバージョン2.4.49をインストールします。 このバージョンは以下で入手できます。 https://archive.apache.org/dist/httpd/CHANGES2.4.49...

CVE-2026-107272

Gophish versions through 0.12.1 are vulnerable to stored and reflected cross-site scripting (XSS) due to unescaped SMTP server error messages . An attacker who controls or intercepts a sending profile's SMTP server can inject malicious scripts. These scripts execute when administrators view campa...

CVE-2026-107272 Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...