CVE-2026-20805-POC

CVE-2026-20805 PoC 针对微软 桌面窗口管理器 dwm.exe 信息泄露漏洞的概念验证。 📋 漏洞摘要 ID: CVE-2026-20805 产品: Microsoft Windows 组件: 桌面窗口管理器 dwm.exe CWE-ID: CWE-200 向未授权行为者暴露敏感信息 严重性 CVSS 3.1: 5.5 中危 攻击向量: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 已通过身份验证的本地攻击者可利用此漏洞泄露远程 ALPC 异步本地过程调用 端口的节区地址，构成用户模式内存泄露。 🚨 影响...

CVE-2026-92461

yshop-crm through 2.1.3 is affected by a missing authorization flaw in the GET /admin-api/crm/flow/flow-users endpoint. Any authenticated back-office user can retrieve approval workflow data, including approval chain topology , step ordering , and approver identifiers , as well as personal inform...

EUVD-2026-80666

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

EUVD-2026-80659

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument currentsegment leads to information disclosure. The attack may be initiated remotely. The identifier o...

CVE-2026-92357

a2ui-project a2ui versions 0.8, 0.9, and 1.0 contain an information disclosure vulnerability in the Model Processor component (file model-processor.ts). The root cause is manipulation of the argument current[segment], which can be triggered remotely by a low-privileged user with no user interacti...

CVE-2026-92357 a2ui-project a2ui Model Processor model-processor.ts information disclosure

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument currentsegment leads to information disclosure. The attack may be initiated remotely. The identifier o...

CVE-2026-29116

CVE-2026-29116 — Dahua 未認証リモートサービス拒否 DoS アドバイザリ種別: ベンダー連携によるセキュリティ開示 CVE ID: CVE-2026-29116 ベンダー: Dahua Technology 公開日: 2026-06-10T06:16:34 UTC 最終更新: 2026-06-10T06:16:34 UTC ソース: Dahua Product Security Incident PSI Trust Center 目次 要点 一目でわかる 脆弱性のタイムライン 説明 技術的分析 影響を受ける製品 CVSS スコアリング 脆弱性スコアリングの詳細 CW...

CVE-2022-47952

Descripción sugerida lxc-user-nic en lxc hasta 5.0.1 se instala con setuid root, y puede permitir a usuarios locales inferir si existe algún archivo, incluso dentro de un árbol de directorios protegido, porque "Failed to open" a menudo indica que un archivo no existe, mientras que "does not refer...

CVE-2022-36163

CVE-2022-36163 推奨説明 pdftoroff hovacui 1.1.0 pdfリーダーにフォーマット文字列の脆弱性が見つかりました。 ユーザーはsprintfの2番目のパラメータを制御でき、これによりDoSまたは情報漏えいが発生し、さらなる攻撃が可能になります。 sprintfcommand, output-postsave, fileno, fileno; 追加情報 これはDoS PoCにすぎません: %n in writable segment detected 1 8518 IOT instruction core dumped python3 exploit.py...

Tool_Exploit_Password_Camera_CVE-2018-9995

ToolExploitPasswordCameraCVE-2018-9995 CVE-2018-9995: https://vulners.com/cve/CVE-2018-9995 1. Googleでキーワード: intitle:"DVR login" を使用して脆弱なデバイスを検索します。 2. 任意のデバイスへのアクセスを試します: デバイスがアクセスするためにユーザー名とパスワードの入力を要求していることがわかります。 3. デバイスのユーザー名とパスワードを取得できるか確認してみます: ツールにデバイスの対応するIPとポートを入力します。 4. 脆弱なデバイス:...

CVE-2020-10977

GitLab プライベートインスタンスの任意ファイル読み取りのための Python エクスプロイト 2020年3月23日、William Bowling によって HackerOne に脆弱性レポートとその PoC が公開されました。 この脆弱性を使用すると、GitLab サーバー上の /etc/passwd などのワールドリーダブルファイル（パーミッション444以上）を読み取ることができます（ワールドリーダブルファイルのみ）。\ root@kitploit: Notice that you should be authenticated user GitLab バージョン 21.9.0...

CVE-2022-31269

CVE-2022-31269 Nortek Control Linear eMerge E3-Series 情報漏えい オプション引数: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" 使用方法 python3 CVE-2022-31269.py -u http://127.0.0.1 python3 CVE-2022-31269.py -f ip.tx...

coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input

A flaw was found in GNU coreutils uniq. When processing specially crafted multibyte input with the --check-chars option, an attacker can trigger an out-of-bounds read. This vulnerability can lead to a denial of service DoS due to an application crash and potentially expose sensitive information...

Moderate: Red Hat Security Advisory: coreutils security update

An update for coreutils is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

EUVD-2026-80521

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...

CVE-2026-89921 KVM: s390: Zero initialize data structures for inject_pfault_token

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...

CVE-2026-89865 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...

CVE-2026-89865

CVE-2026-89865 affects the Linux kernel's qla2xxx SCSI driver (QLogic). The FRU and I2C bsg handlers stage transfers in a 256-byte DMA bounce buffer allocated via dma_pool_alloc() , which does not zero the memory. Only a small leading prefix is initialized (e.g., 36 bytes for a FRU version, 1 byt...

CVE-2026-89846

CVE-2026-89846 is a critical out-of-bounds read in the Linux kernel's qla2xxx SCSI driver. In qla2x00_status_entry(), the FWI2 status path subtracts rsp_info_len (a 32-bit value from the target's FCP response) from par_sense_len (the IOCB data area size: 28 bytes for 24xx, 60 bytes for 29xx) with...

CVE-2026-89838

CVE-2026-89838 affects the Linux kernel's F2FS filesystem . The i_name buffer for recovery filenames is not NUL-terminated, yet recover_inode() and recover_dentry() print it with %s. For a 255-byte filename , recovery logging can read past i_name into subsequent raw inode fields. The fix bounds t...