yolo-cage

yolo-cage: autonomous coding agents that do no harm You're a responsible engineer. You'd never just let an AI run roughshod through your most sensitive systems and codebases. That's why you'd never just shut off the safeguards for a tool like Claude Code. It asks permission for every dangerous...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment 시스템이 다음에 설명된 "speculative execution" 취약점에 대해 평가합니다: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load 경고: 빌드 옵션에서 "Prefer 32-bit"가 선택되어 있지 않은지 확인하십시오. 상승된 권한이 필요합니다 완화를 위해서는 다음이 필요합니다: 1. 바이러스 백신/보안 제품이 Windo...

ExecASLR-ekoparty

ExecASLR - 인텔 분기 예측기를 악용하여 ASLR 우회하기 ASLR이란 무엇인가 ASLRAddress Space Layout Randomization은 메모리 손상 공격의 악용을 더 어렵게 만들기 위해 사용되는 완화 기법입니다. 예를 들어, 버퍼 오버플로 취약점 시나리오에서 Return Oriented ProgrammingROP 익스플로잇을 만들려는 공격자는 체인에 있는 가젯들의 주소를 알아야 합니다. 악용 대상 바이너리의 코드 세그먼트가 무작위화된다면 공격자가 익스플로잇에 올바른 주소를 선택하기 훨씬 어려워지므로 악용...

CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

EUVD-2026-87358

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch...

AZL-104495 CVE-2026-98041 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = mapvalue; / low 32 bits are zero at runtime / r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = u64 r1 + 0; exit; l1: r6 = 0;...

CVE-2017-16995

CVE-2017-16995 직접 파보면서 정리한 CVE-2017-16995 취약점과 관련 분석 （직접 찾을 수 있으면 좋겠다, 웃음 개요 이 취약점은 bpf 가상 실행 시 검증기의 분기 판단 오류로 인해 발생하는 LPE입니다 원리상 정수 확장 취약점입니다 분석 트리거 https://ph4ntonn.github.io/CVE-2017-16995-trigger.html 익스플로잇 https://ph4ntonn.github.io/CVE-2017-16995-exploit.html 구조...

automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

CVE-2026-84711

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

DRUPAL-CONTRIB-2026-177

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

CVE-2026-87979

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

PT-2026-97498

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A validation gap exists in the LaunchConfigurationBaseSerializer.scm branch where the validate scm branch check for leading dashes is missing. This allows the sc...

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

A vulnerability in Nuclei's DAST template loading path allows unsigned code: protocol templates to execute, bypassing the cryptographic signature requirement that is meant to prevent arbitrary command execution from untrusted templates. Affected Component The issue is in the template loader's DAS...

OESA-2026-3931 perl security update

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fixes: Perl versions from 5.9.4 before 5.41.9...

CVE-2026-84451 libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

CVE-2026-85469

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469 Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469

quay-builder-qemu contains a flaw in its release workflow, where the third-party GitHub Action Noelware/docker-manifest-action is pinned to a mutable @master branch . Because the reference is not fixed to a specific commit, a remote attacker who compromises the upstream action repository can inje...