2852 matches found
mruby 资源管理错误漏洞
MRuby is a lightweight implementation of the Ruby language, developed by Makesoftwaresafe as open source. Versions of MRuby 3.4.0 and earlier contain a resource management vulnerability. This vulnerability stems from a flaw in the mrbvmexec function in the src/vm.c file within the JMPNOT-to-JMPIF...
Exploit for CVE-2026-25643
CVE-2026-25643: Frigate NVR = 0.16.3 Authenticated RCE Ex...
CVE-2026-25512 Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution RCE vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled...
CVE-2026-25046
The CVE concerns the Kimi Agent SDK, specifically the development scripts vsix-publish.js and ovsx-publish.js, which pass filenames to shell via execSync(). Prior to v0.1.6, filenames containing shell metacharacters (e.g., $(cmd)) could cause arbitrary command execution. It affects development sc...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the FindContainer function. An attacker can gain unauthorized interactive shell access to containers outside their permitted label scope by directly targeting container IDs through th...
Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access
Summary A flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters for example, label=env=dev to obtain an interactive root shell in out‑of‑scope containers for example, env=prod on the same agent host by directly targeting their container IDs. Note: Tested on v9.0....
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005133)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005133 advisory. In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomizevaspace double read ELF loader uses randomizevaspace twice. It is sysctl...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005028)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005028 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix lockup on kernel exec fault The powerpc kernel is not prepared to handle exec...
PT-2026-4859
Name of the Vulnerable Software and Affected Versions Dozzle versions prior to 9.0.3 Description A flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters to obtain an interactive root shell in out‑of‑scope containers on the same agent host by directly targeting...
Unsafe Dependency Resolution
Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the execglobals parameter in the validate endpoint. An attacker can execute arbitrary cod...
CVE-2026-0770
Langflow execglobals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific...
CVE-2026-0770 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Langflow execglobals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific...
Langflow security vulnerabilities
Langflow is an open-source visualization framework developed by Langflow for building multi-agent and RAG applications. Langflow has a security vulnerability that stems from processing the execglobals parameter, which includes resources from untrusted control ranges, potentially leading to remote...
PT-2026-7855
Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.0 Description A remote code execution flaw exists in the Docker API deployment. The '/crawl' endpoint accepts a hooks parameter containing Python code that is processed using the exec function. Because the import...
Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter
A critical remote code execution vulnerability exists in the Crawl4AI Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing attackers to import arbitrary modules an...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004275)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004275 advisory. A memory leak in the kernelreadfile function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service memory consumption by...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000955)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000955 advisory. The startthread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003619)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003619 advisory. The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs such as /bin/su because installexeccreds is called too late in loadelfbinary in...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002871)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002871 advisory. The startthread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local...
