gix-sec safe.directory protections absent for elevated administrators

Summary In a process run with full administrative rights on Windows, gix-sec wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts. Details In a similar way to Git, gitoxide tries to avoid operating in local...

CVE-2026-0834

CVE-2026-0834（PoC） TP-Link 设备调试协议（TDDP）身份验证绕过（CVE-2026-0834） 概述 TDDP（TP-Link 设备调试协议）服务中的一个漏洞允许本地网络上的未认证远程攻击者执行管理命令。在处理 TDDPv2 数据包时，pktLength 值为 0 会导致 DES 解密例程因短路求值而被跳过。超出 28 字节数据包头的数据被放置在预期存放解密后载荷数据的缓冲区中，从而绕过身份验证，并允许其被解释为有效的命令数据。 攻击者可利用此漏洞执行管理功能，包括在无需凭据的情况下进行恢复出厂设置和设备重启。 该漏洞影响 TDDP...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X 重建分析 CVE-2026-21858：Ni8mare - n8n RCE 全链路利用 1. 执行摘要与概述 本文档对 CVE-2026-21858 漏洞（内部代号 Ni8mare）进行了确定性的技术重建分析。该漏洞的 CVSS 评分为 10.0（严重），存在于 n8n 自动化平台的 Form Webhook 节点中。该缺陷属于 Content-Type 混淆漏洞，可允许未经身份验证的攻击者执行任意文件读取、会话伪造，并最终通过"Execute...

CVE-2026-19233

CVE-2026-19233 is a Server-Side Request Forgery (SSRF, CWE-918) vulnerability affecting a Schneider Electric product (identified by CNA [email protected] and advisory SEVD-2026-251-01 ). An attacker with a privileged account can send crafted, unvalidated parameters to a server endpoint, potent...

EUVD-2026-75105

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...

CVE-2026-19233

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...

wasm2c-tableflip

wasm2c 沙箱逃逸：访客模块在主机上运行 shell 命令 阅读博客：trustsig.eu/blog wasm2c/wasm-rt-impl-tableops.inc 中的 wasmrtallocatefuncreftable 会根据模块声明的元素数量设置 table-size，然后忽略 calloc 的结果。当分配失败时，表会留下 data == NULL 以及完整的声明 size，因此所有边界检查仍会通过，而 table-datai 会变成绝对地址 i sizeofwasmrtfuncreft。 元素数量来自访客，因此访客可以选择分配大小并强制分配失败。 复现...

EUVD-2026-75097

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044

CVE-2026-8044 is a CWE-88 (Argument Injection) vulnerability in Schneider Electric software, enabling remote code execution when a privileged attacker supplies malicious arguments as backup configuration parameters . The CVSS 4.0 score is 8.6 (HIGH) , with low attack complexity and no user intera...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-2441

Google Chrome CSS 远程代码执行漏洞（CVE-2026-2441） 概述 已识别出一个高危漏洞，编号为 CVE-2026-2441，归类于 CWE-416、CWE-416（CVSS 8.8）。在 Google Chrome 145.0.7632.75 之前版本中，CSS 存在释放后使用漏洞，允许远程攻击者通过精心构造的 HTML 页面在沙箱内执行任意代码。（Chromium 安全等级：高危） 详情 CVE 编号 ：CVE-2026-2441 发现日期 ：2026-02-13 发布日期 ：2026-02-13 影响范围 ：机密性、完整性、可用性 漏洞利用可用性...

CVE-2026-79945

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...

CVE-2026-78484

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...

CVE-2026-78493

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...

CVE-2026-Termius

Termius macOS Application Vulnerability Report CVE-2026-Termius Target : Termius macOS Version Tested : Latest as of Jan 2026 Impact : Remote Code Execution RCE, Local Privilege Escalation LPE, App Security Bypass 🚨 Executive Summary Three critical vulnerabilities were identified in the Termius...

POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — Escritura Arbitraria de Archivos + Inyección XML → Ejecución Remota de Código Tabla de Contenidos Descripción General Detalles de la Vulnerabilidad Cadena de Ataque Requisitos Instalación Configuración Uso Cómo Funciona Código Vulnerable Lista de...

CVE-2024-3408-dtale

CVE-2024-3408 - D-Tale 身份验证绕过与 RCE 用于复现 CVE-2024-3408 的可复现实验室环境，该漏洞是 D-Tale 中的身份验证绕过和远程代码执行漏洞。 漏洞 D-Tale 3.15.1 及更早版本存在漏洞，原因如下： 1. 硬编码的 SECRETKEY （"Dtale"）用于 Flask 会话签名——允许伪造会话 Cookie 2. 通过自定义过滤器执行代码 ——test-filter 端点使用 pandas query，可被滥用以执行任意 Python 代码 CVSS ：9.8（严重） 受影响版本 ：D-Tale = 3.15.1 快速开始...

poc-2025-9074

CVE-2025-9074 | Docker API CVE-2025-9074 PoC Proof-Of-Concept A sophisticated exploitation framework for CVE-2025-9074, targeting unauthenticated Docker API endpoints with an integrated interactive command shell. Overview This tool automates the exploitation of exposed Docker API instances withou...

CVE-2026-22018-Jenkins-Pipeline-Shared-Library-Code-Execution-via-Grab-

CVE-2026-22018 – 通过 @Grab 的 Jenkins Pipeline 共享库代码执行 程序代码（Groovy 流水线） root@kitploit: // Jenkinsfile - loads untrusted shared library @Library'evil-library@master' node evilStep CVE-2026-22018 – Jenkins Pipeline 共享库远程代码执行 概述 Jenkins 流水线从并非完全可信的源加载共享库。该库使用 @Grab 注解下载外部 Maven 构件，其中可能包含恶意类，在 Groovy...