CVE-2023-23946-POC

Exploit PoC CVE-2023-23946 Explicación y PoC de la CVE-2023-23946 La vulnerabilidad CVE-2023-23946 es causada por un fallo en la forma en que git maneja los enlaces simbólicos. Cuando git crea un enlace simbólico, en realidad no lo maneja como un enlace simbólico y, debido a eso, podemos explotar...

GO-2026-6645 LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI

LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tcpbpf: Fixed the skmemuncharge logic in tcpbpfsendmsg. The current sk memory accounting logic in SKREDIRECT involves pre-charging bytes to be sent, where the value is either msg-sg.size or a smaller value, applybytes. Potential...

Astra Linux – Vulnerability in Git

Git is a revision control system. Before versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, feeding specially crafted input to git apply --reject could cause a path outside the working tree to be overwritten with partially controlled contents...

CVE-2026-60004

CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea diffpatch Git Hook RCE PoC ★ https://github.com/user-attachments/assets/403a70f4-4ff4-4ab7-b11c-d73d70adaf0b Overview CVE-2026-60004 is a Remote Code Execution RCE vulnerability in Gitea. The diffpatch API applies a supplied patch with git...

GHSA-647F-G98J-QQ25 vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js process when an embedder-exposed host Promise rejects. This is an incomplete fix for GHSA-m283-3h24-438v: the advisory's capability-bearing rejection rebuild runs only through this...

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js process when an embedder-exposed host Promise rejects. This is an incomplete fix for GHSA-m283-3h24-438v: the advisory's capability-bearing rejection rebuild runs only through this...

NPM: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

NPM: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection vulnerability discovered by ? in WordPress Npm vm2 versions 3.11.6...

CentOS Linux 7 [TuxCare] Security Update: emacs-git / emacs-git-el / git / git-all / git-bzr / git-cvs / etc (CENTOS7:CLSA-2024:1714728645)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1714728645 advisory. - Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32....

Exploit for CVE-2026-600004

CVE-2026-60004 - Functional script — Gitea RCE via diffpatch G...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2023-001354)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001354 advisory. Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially...

CVE-2026-93603

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

EUVD-2026-82898

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

Arbitrary Code Injection

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection in the handling of rejected host Promises via call or apply indirection. An attacker can execute arbitrary commands with the...

CVE-2026-92937 vm2 3.11.6 Remote Code Execution via Promise call/apply

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...

CVE-2026-92937 vm2 3.11.6 Remote Code Execution via Promise call/apply

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...

CVE-2026-92937

vm2 3.11.6 (a Node.js sandboxing library) is vulnerable to a sandbox escape resulting in remote code execution in the host process. The root cause is an incomplete fix for a prior advisory (GHSA-m283-3h24-438v): the bridge gate at lib/bridge.js:1624 only identity-checks the direct call target, so...

PT-2026-94436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth RFCOMM component where the rfcomm apply pn function accepts a Maximum Transmission Unit MTU value from a remote Parameter Negotiation PN frame without...

PT-2026-93645

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the damon apply min nr regions function where the system repeatedly splits regions to meet a user-defined minimum limit. The process relies on the damon split region a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in applyconstrainttosize The step variable is initialized to zero. It is changed during the loop, but if it isn’t changed, it will remain zero. Add a variable check before the division...