CVE-2023-51444

このREADMEは、GeoServer開発の開始を支援します。ソースコードのチェックアウト、コンパイル、実行のプロセスを案内します。 GeoServerの開発には、Java 8、Maven、gitが必要です。Javaクラスライブラリの微妙な変更のため、現時点ではJava 8での開発が必要です（ただし、結果はJava 11でテストされています）。 参考資料: http://docs.geoserver.org/latest/en/developer/index.html == Linux == 1. 前提条件のインストール LinuxディストリビューションからOpenJDK...

PT-2026-107641

Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...

PT-2026-107418

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

PT-2026-107532

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

PT-2026-107417

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

xzutils_backdoor_obfuscation

xzutilsbackdoorobfuscation このスクリプトは、XZ utils攻撃（CVE-2024-3094）で使われた難読化技術を再現します。 これは xzutils v5.6.0 でのみテストされています。 ⚠️ このコードは教育目的のみで提供されており、悪意のある活動に使用してはなりません。自己責任でご使用ください。 ⚠️ 前提条件 元の good-largecompressed.lzma を xzutils 5.6.0 から作業フォルダに置いておく必要があります。 使用方法 以下を実行します ./obfuscatepayload.sh yourpayload...

CVE-2026-106509

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write...

CVE-2026-106509 Backstage: Improper validation of MkDocs theme configuration in TechDocs

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write...

CVE-2026-106509 Backstage: Improper validation of MkDocs theme configuration in TechDocs

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write...

CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.21.36 security update

Red Hat build of MicroShift release 4.21.36 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

Code-27-Companion-Hub-Exploits

Code 27 3D Companion Hub 漏洞（CVE-2026-36027, CVE-2026-36028） Code 27 3D Companion Hub 是一款实体桌面设备，可渲染定制的 AI 角色（"Codie"）作为动画化的 3D 伴侣。用户可以上传或创建任意 3D 模型，多模态 AI 使角色能够观察周围环境、读取语气和肢体语言，并进行开放式对话。 本文涉及两个需要物理接触设备的漏洞。两者均在以下构建版本上验证，且在发布时尚未修补。 受影响设备 / 构建版本 字段| 值 ---|--- 产品| Code 27 3D Companion Hub Companion Hu...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE 漏洞 xpl0ited by infrar3d 本概念验证利用针对 Langflow 1.9.0 之前版本中的一个严重远程代码执行（RCE）漏洞。该漏洞允许未经身份验证的攻击者通过向流程构建 API 端点注入恶意 Python 代码来执行任意系统命令。漏洞存在于 /api/v1/buildpublictmp/flowid/flow 端点中，该端点未能正确清理组件模板中 code 字段的用户提供代码。 使用方法： python3 CVE-2026-33017.py --help usage: CVE-2026-33017.py -...

AZL-105993 CVE-2026-98325 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

EUVD-2026-93310

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

Important: Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 3.3.3 GA ]

An update to the images for Red Hat build of Apicurio Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of...

crushftp_cve-2025-31161

CrushFTP 10.8.0 — CVE-2025-31161 脆弱性ビルド CVE-2025-31161 の許可された侵入テスト用に事前ビルドされた CrushFTP 10.8.0 バイナリ。 !CAUTION これは意図的に脆弱な アプリケーションビルドです。 許可されたセキュリティテストおよび研究目的のみに使用してください。 本番システムにデプロイしたり、信頼できないネットワークに公開したりしないでください。 含まれるもの リリースアセット CrushFTP1010.8.04.zip には、netlah/crushftp:10.8.04 Docker イメージから抽出された...

OwnCloud-CVE-2023-49103

构建容器的方法： 1: 下载文件夹，解压并构建容器。 2: docker build -t cve-2023-49103 ./ 3: docker run --name cve-2023-49103 -p 80:80 -p 443:443 cve-2023-49103...

[SECURITY] Fedora 45 Update: ocaml-omake-0.10.7-11.fc45

OMake is a build system designed for scalability and portability. It uses a syntax similar to make utilities you may have used, but it features many additional enhancements, including the following. Support for projects spanning several directories or directory hierarchies. Fast, reliable,...