CVE-2026-32604

CVE-2026-32604 - RCE mediante artefacto GitRepo de Spinnaker CVE-2026-32604 - Ejecución remota de código en Spinnaker a través del tipo de artefacto git/repo. Esta es una vulnerabilidad de inyección de comandos / ejecución remota de código en el manejo de artefactos GitRepo de Spinnaker. La...

CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

Exploit for Improper Input Validation in Linuxfoundation Spinnaker

CVE-2026-32604 - Spinnaker GitRepo Artifact RCE CVE-2026-...

CVE-2026-54565 rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

CVE-2026-54565

rhwp is an HWP viewer/editor built in Rust and WebAssembly, distributed as Chrome and Firefox browser extensions . In versions prior to rhwp 0.7.15 and extension 0.2.4 , the service workers perform privileged fetches without validating message senders, URL schemes, or destination addresses, despi...

CVE-2026-81515 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient deserializes the registry response as one unit, and an unrecognized actionType or status, a non-Boolean...

CVE-2026-81515

Steeltoe.Discovery.Eureka (versions 4.0.0 through 4.3.0) deserializes the Eureka registry response as a single unit. A malformed actionType , status , isCoordinatingDiscoveryServer , or timestamp field aborts the entire fetch, affecting the JsonInstanceInfoConverter , BoolStringJsonConverter , an...

CVE-2026-61793 Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

CVE-2026-54565: Exposure of Sensitive Information to an Unauthorized Actor

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

VulnCheck KEV: CVE-2026-32255

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch server-side, and returns the...

VulnCheck KEV: CVE-2026-40242

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation...

halo-cve-2026-67919

通过 URL 触发的 Halo 插件 RCE Halo 的控制台允许管理员通过粘贴 URL 来安装和升级插件。它会获取任意 URL，安装 jar，而 jar 中的代码会在服务器上运行。不检查 scheme、不检查主机、跟随重定向，插件管理器会直接从 jar 中加载扩展类。 这就是 cve-2026-67919（install-from-uri / upgrade-from-uri）、cve-2026-67920（迁移恢复）、cve-2026-67921（csrf/cors 链）。这三者均已在 2026 年 8 月的 docker 实验环境中针对 halohub/halo:2.25.4...

CVE-2025-8110-PoC

CVE-2025-8110 概念验证 Python 概念验证脚本，针对 CVE-2025-8110 — Gogs v0.13.3 UpdateRepoFile 符号链接远程代码执行。单次攻击：恶意 PUT 请求本身触发 git fetch → sshCommand → 反弹 shell。 ⚠️ 仅供教育和授权安全研究使用。 针对你不拥有或未经书面许可测试的系统运行此工具是非法的。 详情 针对 CVE-2025-8110 的 PoC 受影响版本：Gogs v0.13.3 已修复版本：Gogs v0.13.4...

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

EUVD-2026-80792

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380

WuzhiCMS up to 4.1.0 is affected by a server-side request forgery (SSRF) vulnerability in the Remote Image Fetch component. The flaw resides in the function ckditor::saveRemote within coreframe/app/attachment/index.php , where manipulation of the source[] argument allows an unauthenticated, remot...

CVE-2026-21636

CVE-2026-21636 - Node.js 权限模型 UDS/网络绕过 漏洞摘要 Node.js 权限模型 （--permission）旨在通过限制对文件系统、子进程、工作线程和网络的访问来对进程进行沙箱化。CVE-2026-21636 揭示了通过 undici/fetch（以及 net/tls）到 Unix 域套接字 和本地 TCP 地址的连接完全绕过了网络防护，即使未设置 --allow-net 也是如此。 受影响：Node.js v25（网络权限在披露时仍处于实验阶段）。 此 PoC 在 v22 上复现了该概念，其中可以观察到相同的绕过行为。 能够向在...

CVE-2026-5061

CVE-2026-5061 Consul Template 在模板评估期间验证了符号链接的指向位置，但其后的依赖项获取读取的却是原始路径。在这两个操作之间重新定向链接，会将沙箱内的文件引用变成沙箱外的文件泄露。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题，当时我带着一个非常具体的安全疑问： 如果sandboxpath 在模板评估期间验证了符号链接，那么后续的文件读取是否仍然绑定到同一个已验证的目标？ 在这个案例中，答案是否定的。 file...

Triple_fetch

triplefetch - ianbeer https://bugs.chromium.org/p/project-zero/issues/detail?id=1247 这是针对 CVE-2017-7047 的利用程序，该漏洞是 libxpc 中的一个逻辑错误，允许恶意消息发送者发送由共享内存支持（backed）的 xpcdata 对象。xpc 消息的消费者似乎没有预料到，当接收者正在处理 xpcdata 对象时，其缓冲区的内容可能被发送者修改。 该项目利用 CVE-2017-7047 构建了一个概念验证的远程 lldb debugserver 存根（stub），能够附加到 iOS...