CVE-2026-45051

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be...

CVE-2025-55182-React2Shell

CVE-2025-55182-React2Shell Разработано infrar3d Уязвимость критической степени тяжести 10.0, затрагивающая серверное использование React.js, отслеживаемая как CVE-2025-55182 в React.js и CVE-2025-66478 специально для фреймворка Next.js. Эта уязвимость была ответственно раскрыта Lachlan Davidson 2...

CVE-2026-57141

PraisonAI (praisonai npm, a TypeScript multi-agent AI framework) is vulnerable to remote code execution via its codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts. The tool executes LLM-generated JavaScript using new Function() with a with(sandbox) pattern guarded by a regex blockl...

CVE-2026-57141 PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function and withsandbox, while a regular-expression blocklist can be bypassed with Function'return this' to recover the glob...

cve-2010-2075-analysis

CVE-2010-2075 – Удаленное выполнение кода через бэкдор в UnrealIRCd Обзор Этот репозиторий документирует анализ и эксплуатацию CVE-2010-2075, уязвимости-бэкдора, затрагивающей UnrealIRCd 3.2.8.1. Уязвимость была воспроизведена в контролируемой лабораторной среде с использованием Metasploitable 2 ...

CVE-2017-0144

🔵 EternalBlue CVE-2017-0144 Vulnérabilité critique d'exécution de code à distance dans Microsoft SMBv1 📌 Aperçu EternalBlue est une vulnérabilité critique dans le protocole Server Message Block version 1 SMBv1 de Microsoft qui permet à des attaquants distants d'exécuter du code arbitraire sur des...

CVE-2026-39107

CVE-2026-39107: Межсайтовый скриптинг XSS в Kimi AI v1.0 Описание Уязвимость межсайтового скриптинга XSS существует в функции «Preview» веб-интерфейса Kimi AI v1.0. Приложение не выполняет надлежащую очистку или кодирование полезных нагрузок HTML/JavaScript, генерируемых моделью ИИ. Когда...

LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298

LetsDefend SOC336 : Détection d'une exploitation RCE Zero-Click OLE Windows Ce dépôt documente mon enquête sur une alerte LetsDefend impliquant une exploitation RCE zero-click OLE Windows liée à CVE-2025-21298. L'objectif est de montrer le raisonnement derrière la conclusion, du triage des e-mail...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

CVE-2026-48017

CVE-2026-48017 — Remote Code Execution in DbGate via functionName injection Severity : High CVSS 8.8 CWE : CWE-94 — Improper Control of Generation of Code 'Code Injection' Affected : dbgate-api ≤ 7.1.8 patched in 7.1.9 Advisory : GHSA-hv83-ggc4-v385 NVD :...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.14 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.14 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

CVE-2026-35273

🚨 CVE-2026-35273 - Удаленное выполнение кода без аутентификации в Oracle PeopleSoft PeopleTools ⚠️ Критическое RCE без аутентификации в Oracle PeopleSoft PeopleTools Уязвимость, затрагивающая Oracle PeopleSoft Enterprise PeopleTools, позволяющая удаленным злоумышленникам скомпрометировать уязвимые...

nextjs-security-update

nextjs-security-update Есть люди, создающие OSS-инструменты для эксплуатации новых уязвимостей Next.js. Этот инструмент — ответный удар: он максимально упрощает обновление всех ваших Next.js-приложений во всех ваших GitHub-аккаунтах. Под капотом используется официальный инструмент исправления от...

EUVD-2026-78367

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

CVE-2026-47424 OpenAM Authenticated RCE via Groovy Sandbox Escape

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

CVE-2026-19515

CVE-2026-19515 is an OS command injection vulnerability in the WSO2 Integrator MI VS Code extension . The extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources , allowing a crafted project to inject and execute...

CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be...

CVE-2026-42945-Reverse-Shell-POC

CVE-2026-42945 NGINX Rift RCE PoC с обратной оболочкой Концептуальный эксплоит PoC удаленного выполнения кода для CVE-2026-42945 , переполнение буфера в куче в модуле ngxhttprewritemodule NGINX. Этот форк дополняет публичный PoC-триггер встроенным слушателем обратной оболочки и настраиваемыми...

CVE-2026-45794

OpenAM Community Edition (through 16.0.6 ) is vulnerable to unsafe Java deserialization (CWE-502) in its Push Notification SNS callback resource (SnsMessageResource ). The route is mounted with anonymous access ; after a message ID expires from the in-memory dispatcher, it falls back to a CTS-sto...