INTACT

SoK 多轮越狱实验 本仓库包含 SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks 中机制分析所用代码的发布版本。 本仓库已进行精简，仅保留论文附录 A 所述实验所需的代码、提示词、配置文件与数据集。生成的日志、缓存文件、虚拟环境、先前结果、图表以及临时分析输出均已有意移除。 实验映射 论文问题| 方法| 类别| 本地目录| 数据集 ---|---|---|---|--- RQ1：组织 vs. 累积| FITD, MRCJ| DEA / SRA| Foot-in-the-door-Jailbreak/,...

[SECURITY] [DLA 4801-1] swift security update

Debian LTS Advisory DLA-4801-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara September 29, 2026 https://wiki.debian.org/LTS Package : swift Version : 2.30.1-0+deb12u3 CVE ID : CVE-2026-71191 CVE-2026-97149 Debian Bug : 1142972 1148834 Two...

Thank-u-Next

Thank u Next – CVE-2025-29927 エクスプロイトツール 🧠 CVE-2025-29927 とは？ これは単なるバイパスではありません — 啓示です。たった一つのヘッダーが、ミドルウェアのロジックによって誤解され、誤って処理されることで、本来ロックされるべきものへのマスターキーとなります。 CVE-2025-29927は、設定ミスのあるミドルウェア認証レイヤー 、特にヘッダー x-middleware-subrequest を発信元やコンテキストを検証せずに信頼するシステムを悪用します。 簡単に言うと？ たった一つのヘッダーを追加するだけで、ブーム —...

golang-x-text

Go Text 本仓库包含用于文本处理的补充 Go 包，其中许多涉及 Unicode。 CLDR 版本控制 确保 x/text 中使用的 Unicode 版本与你的 Go 编译器使用的版本一致非常重要。x/text 仓库支持多个 Unicode 版本，并将 Unicode 版本与 Go 编译器的版本匹配。目前，这支持 Go 编译器从版本 1.7 开始。 贡献 要向本仓库提交更改，请参阅 http://go.dev/doc/contribute。 git 仓库是 https://go.googlesource.com/text。 要生成此仓库中的表格（编码表除外），请在此目录中运行 go...

CVE-2026-102630: Use of Less Trusted Source

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...

Amazon Linux 2 : python-tornado (ALAS-2026-3925)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3925 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses...

CVE-2026-35189: Allocation of Resources Without Limits or Throttling

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

Oracle Linux 10 : python-cryptography (ELSA-2026-71658)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-71658 advisory. 43.0.0-4 - Fix CVE-2026-69249: add X.509 signature validation budget Tenable has extracted the preceding description block directly from the Oracle Linux...

Linux Distros Unpatched Vulnerability : CVE-2026-35189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions...

Linux Distros Unpatched Vulnerability : CVE-2026-94286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients. CVE-2026-94286...

CVE-2026-35189: Allocation of Resources Without Limits or Throttling

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

CVE-2026-84783

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server...

Amazon Linux 2 : python3-tornado (ALAS-2026-3924)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3924 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

Debian dla-4801 : python3-swift - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4801 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4801-1 [email protected]...

UBUNTU-CVE-2026-84783

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server...

Use-After-Free in X.509 Extension Cache Under Concurrent Use

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server...

Linux Distros Unpatched Vulnerability : CVE-2026-84783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 授权绕过复现 本仓库是对 next 包中 CVE-2025-29927 漏洞的复现。 如何复现 1. 按照以下步骤克隆并运行 Next.js 应用程序 2. 测试授权是否拒绝访问 /api/hello 端点 $ curl http://localhost:3000/api/hello "error":"Unauthorized"% 3. 测试在提供令牌时授权是否正常工作 $ curl -H "Authorization: my-jwt-token-here" http://localhost:3000/api/hello "message":"Hello...