readme2demo v0.7.2

readme2demo — verified tutorials & demo videos from your README ▶ readme2demo generating its own tutorial: an AI agent runs this repo's README in a sandbox, a fresh container replays every step, then the demo is rendered. Full self-run output in examples/readme2demo · run against another project ...

Malicious code in confluent-docker-utils (PyPI)

Source: kam193 bc7d66b033c3d09c07ce3226cd534199a9f8cb2200a79035526192fb140b94d9 The package is designed to exfiltrate basic data, like hostname and OS details, as well as collect information about the stacktrace it's imported from. --- Category: PROBABLYPENTEST - Packages looking like typical...

SUSE-SU-2026:22887-1 Security update for docker-compose

This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration bsc1239766. - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the...

CVE-2026-64824 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

CVE-2026-64824 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

EUVD-2026-46300

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

CVE-2026-64824 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:3126-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3126-1 advisory. This update for podman rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

PT-2026-61977

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

CVE-2026-57117

"LocalManagedAgent" / "SandboxedAgent" compute bridging wraps "readfile", "listfiles", and "writefile" when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An...

fastjson-jsontype-rce-lab

fastjson @JSONType remote-class-load RCE — lab, exploit & sc...

Important: runfinch-finch

Issue Overview: containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted ima...

engineering-agent-harness-poc

Engineering Agent Harness — POC skeleton What this proves:...

Exploit for CVE-2026-63030

wp2shell-scan A scanner and proof-of-concept toolkit for CVE-202...

Use Of Hard-coded Cryptographic Key

Kimai is vulnerable to Use of Hard-coded Cryptographic Key. The vulnerability is due to the official Docker image using a publicly known default APPSECRET that is neither overridden nor validated, which allows an unauthenticated attacker to forge HMAC-signed cookies and login links to compromise...

redteam-work-test

Cyber red-team screening task A self-contained red-team chall...

GHSA-Q38V-WP89-2W55 sh _uid does not drop supplementary groups (incomplete privilege drop)

Impact The uid option performed an incomplete privilege drop on Linux/Unix-like systems. When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

Exploit for Out-of-bounds Read in Openssl

CVE-2014-0160 Lab dựng lab sử dụng Heartbleed để leak memory...

Exploit for Out-of-bounds Read in Openssl

CVE-2014-0160 Lab dựng lab sử dụng Heartbleed để leak memory...

Copy Fail Docker Escape via Modprobe (CVE-2026-31431)

Exploits CVE-2026-31431 Copy Fail / authencesn AEAD page-cache write from inside a Linux container to overwrite /proc/sys/kernel/modprobe, plant a host payload, and trigger requestmodule for host code execution. Requires a writable host path privileged container, shared PID+mount, or hostPath e.g...