CVE-2026-24061

CVE-2026-24061: GNU InetUtils telnetd 認証バイパス - 詳細分析 エグゼクティブサマリー CVE-2026-24061 は、GNU InetUtils telnetd における重大な（CVSS 9.8）リモート認証バイパス脆弱性であり、認証されていない攻撃者が即座に root アクセスを取得できるようにします。この脆弱性は、USER 環境変数の不適切なサニタイズに起因し、この変数がコマンドライン引数として /usr/bin/login に直接渡されます。攻撃者が USER=-f root を設定することで、login の -f...

CVE-2026-24061-Scanner

CVE-2026-24061 Scanner: GNU Inetutils Telnet Exploit Checker CVE-2026-24061 Scanner は、GNU Inetutils パッケージの telnetd サービスにおける 認証バイパス の脆弱性に対する検出（ reconnaissance ）と能動的な検証（ active exploitation check ）を行う Bash Script ベースのツールです。 この脆弱性により、攻撃者は環境変数 USER を介した Argument Injection を利用して、パスワードなしで root...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

SummaryThe dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

cve-2026-80428-ctf

CVE-2026-80428 CTF Training Lab Educational emulator of the vulnerability mechanics described in CVE-2026-80428 CWE-502: Deserialization of Untrusted Data. This is not a real ILIAS installation and not a weaponized exploit package. It is a fully containerized, isolated laboratory for students,...

Malicious code in @hrmony/app-gateway-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d3f05113dd7daa9fac2da8187afecc751fafcf96449e7f4eb4a5d9a4878844 On require/import of @hrmony/app-gateway-templates, index.js the package main executes an exfiltration routine against a hardcoded attacker endpoint ...

Malicious code in @hrmony/benefit-sachbezug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...

Malicious code in @hrmony/pladddform-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f0706d7223f8a1ff87ac80c6e1e42af148214545e55acc865cce12fee7eec4 On module load, index.js unconditionally beacons to the hardcoded non-first-party endpoint...

CVE-2026-24061

🚨 CVE-2026-24061 — “TelneTD” GNU Inetutils telnetd의 치명적인 원격 인증 우회 2015년의 유령이 돌아와 여전히 텔넷을 실행 중인 모든 것을 장악합니다. 인증 제로. 환경 변수 하나. 즉시 루트 쉘. ⚠️ 개요 CVE-2026-24061 은 GNU Inetutils telnetd ≤ 2.7 에서 발견된 심각한 원격 권한 상승 취약점입니다. 인증되지 않은 원격 공격자는 Telnet NEW-ENVIRON 옵션을 통해 USER 환경 변수를 "-f root"로 설정합니다. telnetd는 이를...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-97922

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit...

CVE-2026-100176: Improper Neutralization of Input During Web Page Generation

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

PT-2026-98726

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the btf var show function. This occurs because the function calls btf type id resolve unconditionally, which attempts to dereference btf-resolved ids...

CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

CVE-2026-92591

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

GHSA-RRXG-G2PF-6HH4 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allowed execution with unnecessary privileges. Since Exim operates as root in the spool directory owned by a non-root user, an attacker could write to the /var/spool/exim4/input spool header file. A crafted recipient address in that file could indirectly lead to command...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit allocation of the cpumask variable on the stack. For the CONFIGCPUMASKOFFSTACK=y kernel, explicit allocation of the cpumask variable on the stack is not recommended, as it may cause a potential stack...