ChromeSHELFLoader

Chrome SHELF Loader CVE-2020-6418 のエクスプロイトで、SHELF Loader を実装しています。 「Tmp.0ut volume 2」の一部として公開されました。...

Langflow < 1.9.0 - Remote Code Execution

Langflow versions prior to 1.9.0 are vulnerable to unauthenticated remote code execution RCE via the buildpublictmp endpoint. Attackers can submit a manipulated flow JSON containing Python code that is executed during the build process without proper sandboxing. id: CVE-2026-33017 info: name:...

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

CVE-2026-21002 – 再利用された /tmp を介したサーバーレスコールドスタート資格情報漏えい プログラムコード（Python AWS Lambda シミュレーション） lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm starts def handlerevent: On first invocation, write a secret if not...

CVE-2026-41900-POC

OpenLearnX-RCE OpenLearnX コンテナボリュームマウントによる認証不要のRCE 差分ベースの検出 → サイレントパッチ → サンドボックスエスケープ → /tmp の完全開示 プロパティ| 値 ---|--- 名前| OpenLearnX-RCE CVE| CVE-2026-41900 GHSA| GHSA-8h25-q488-4hxw タイプ| 認証不要の情報開示 / RCE 影響を受けるバージョン| OpenLearnX コミット 14765d7 修正バージョン| コミット 14765d7 realcompilerservice CVSS| 8.6 高 CWE|...

google-osconfig-privesc

概要 googleosconfigagent プロセスは、GoogleCloudPlatform https://github.com/GoogleCloudPlatform/osconfig ツールのコンポーネントであり、各 VM 上でデフォルトで実行されます。このエージェントは root として実行され、OS config https://cloud.google.com/compute/docs/os-config-management を含むいくつかのユーザー制御可能なサービスを担当しています。OS config は、Google...

cve-2022-21658

CVE-2022-21658 poc Rust 1.58.0 バージョンを使用していることを確認してください 。 最初に実行: while :; do mkdir /tmp/legit; rm -r /tmp/legit; ln -s /tmp/sensitive /tmp/legit; done 次に: cargo run...

Rocky Linux 8 [CIQ] Security Update: socat / socat-debuginfo / socat-debugsource (crlsa-2025_11042)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511042 advisory. socat: arbitrary file overwrite via predictable /tmp directory CVE-2024-54661 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: socat / socat-debuginfo / socat-debugsource (crlsa-2025_10353)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510353 advisory. socat: arbitrary file overwrite via predictable /tmp directory CVE-2024-54661 Tenable has extracted the preceding description block directly from the CIQ security...

Security Bulletin: Vulnerabilities in Netty,Apache Log4j Core,Spring Boot,Spring Framework,PostCSS,tmp,Spring Data,Apache Commons Lang,React Router,Bootstrap,d3-color might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Apache Log4j Core, Spring Boot, Spring Framework, PostCSS, tmp, Spring Data, Apache Commons Lang, React Router, Bootstrap,d3-color. Vulnerabilities include The attacker can present a server certificate...

CVE-2026-48907

CVE-2026-48907 教育用PoC ⚠️ このリポジトリは教育および防御的なセキュリティ目的のみに使用されます。必ず、自分が所有するシステム、または明示的に評価を許可されたシステムに対してのみテストしてください。このプロジェクトを第三者システムに対して使用しないでください。 このPoCは、Joomla Content Editor JCE のバージョン 2.9.99.4 までに影響する未認証のRCE脆弱性である CVE-2026-48907 を実証します。 これは、JCEのプロファイルインポート機能における認証と検証の欠如を悪用します。 これは BIBIL0DAYのオリジナルPoC...

CVE-2026-101054

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function getfile of the file /tmp/wpasupplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2026-054036)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054036 advisory. Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege...

PT-2026-96030

Name of the Vulnerable Software and Affected Versions QCMS versions prior to 6.0.7 Description A remote SQL injection exists in the Content Detail Page component within the self Tmp function located in the Lib/Config/Controllers.php library. The issue occurs when the ID argument is manipulated...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

Astra Linux – Vulnerability in Thunderbird

By creating a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the...

Astra Linux – Vulnerability in Mariadb 10.3

A issue in the Createtmptable::finalize component of MariaDB Server v10.7 and below was discovered. This issue allows attackers to cause a Denial of Service DoS attack through specially crafted SQL statements...

CVE-2026-86347: Missing Authorization

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

CVE-2026-80663

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

UBUNTU-CVE-2026-80663

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-bundler (UTSA-2024-005590)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005590 advisory. Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directo...