CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-84809

Tencent AI-Infra-Guard 's skill-scan component (affected in v4.6.0) hardcodes __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. An attacker can distribute a skill containing benign Python source files alongside malicious compiled bytecode tha...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — حقن قواعد التحقق في CodeIgniter 4 CVE-2023-32692 هي ثغرة حقن برمجي في إطار عمل PHP CodeIgniter 4، وتؤثر على الإصدارات من 4.0.0 حتى 4.3.4. تم إصلاحها في الإصدار 4.3.5 صدر في يونيو 2023. هذه بيئة تجريبية لمن يريد التجربة بها. يمكن العثور على تفاصيل الثغرة في مدونة MOGWAI LABS. بيئة...

CVE-2026-23885

استشارة أمنية: CVE-2026-23885 تنفيذ التعليمات البرمجية عن بُعد RCE بعد المصادقة في AlchemyCMS 1. الملخص التنفيذي تم اكتشاف ثغرة أمنية حرجة تتعلق بـ عدم تحييد التوجيهات في التعليمات البرمجية المُقيَّمة ديناميكيًا CWE-95 في إطار عمل AlchemyCMS. تسمح هذه الثغرة لمستخدم مُصادق يتمتع بصلاحيات إدارية...

CVE-2026-52831

CVE-2026-52831 affects Nuclio , a serverless framework for real-time events and data processing. In versions prior to 1.16.4 , the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, ). Two fields in the...

CVE-2026-4802

CVE-2026-4802 - تنفيذ التعليمات البرمجية عن بُعد عبر حقن الأوامر في Cockpit إثبات مفهوم لاستغلال CVE-2026-4802، وهو تنفيذ تعليمات برمجية عن بُعد عبر حقن الأوامر في واجهة سجلات النظام في Cockpit loadServiceFilters الإعداد قم ببناء وتشغيل البيئة القابلة للاستغلال: root@kitploit: $ docker build -t...

EUVD-2026-70216

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...

CVE-2026-82404 TOON: Prototype pollution when decoding untrusted TOON input

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In...

CVE-2026-82404 TOON: Prototype pollution when decoding untrusted TOON input

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X تحليل إعادة البناء CVE-2026-21858: Ni8mare - سلسلة استغلال كاملة لـ RCE في n8n 1. الملخص التنفيذي والنظرة العامة تقدم هذه الوثيقة تحليلًا تقنيًا حتميًا لإعادة بناء ثغرة CVE-2026-21858، المُسمّاة داخليًا Ni8mare. تحمل هذه الثغرة درج...

wasm2c-tableflip

wasm2c sandbox escape: وحدة ضيف تشغّل أمر قشرة على المضيف اقرأ المدونة: trustsig.eu/blog wasmrtallocatefuncreftable في wasm2c/wasm-rt-impl-tableops.inc يضبط table-size من عدد العناصر المُعلن في الوحدة ثم يتجاهل نتيجة calloc. عندما يفشل التخصيص، تبقى الجدول مع data == NULL وsize الكامل المُعلن، لذ...

CVE-2026-2441

CSS في Google Chrome قبل تنفيذ التعليمات البرمجية عن بُعد CVE-2026-2441 نظرة عامة تم تحديد ثغرة أمنية بدرجة خطورة HIGH، مصنفة باسم CVE-2026-2441، ضمن فئة CWE-416، CWE-416، CVSS 8.8. سمحت ثغرة الاستخدام بعد التحرير Use after free في CSS في Google Chrome قبل الإصدار 145.0.7632.75 لمهاجم عن بُعد...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

CVE-2026-84645

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

EUVD-2026-70201

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 L3 virtual routing and...

CVE-2026-20212

CVE-2026-20212 affects the Silicon One Hardware Abstraction Layer (S1HAL) in Cisco Nexus 9000 Series Switches . The root cause is that TCP ports 43210 and 43211 are accessible in the default Layer 3 VRF, allowing an unauthenticated, remote attacker to send crafted input that executes code with ro...

CVE-2026-20212 Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 L3 virtual routing and...

CVE-2026-53611 Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...