CVE-2023-4357-Chrome-XXE

ツール概要 世界初の単一ファイルでCVE-2023-4357 Chrome XXE脆弱性を利用するEXP。訪問者のローカルファイルを窃取可能。 世界初の単一ファイルでCVE-2023-4357 Chrome XXE脆弱性を利用するEXP。攻撃者が訪問者のローカルファイルを取得可能。...

CVE-2015-3306

CVE-2015-3306 これは、ProFTPd 1.3.5 の modcopy CVE-2015-3306 脆弱性に対する単一ファイルのエクスプロイトです。特に TryHackMe Kenobi Lab 向けです。 脆弱性の説明 CVE-2015-3306 は、ProFTPd 1.3.5 に見つかった脆弱性で、FTPファイルコピー操作を有効にする modcopy モジュールの欠陥に起因します。この脆弱性により、THMプレイヤーはSSH秘密鍵を共有領域にコピーし、それをローカルシステムにマウントできるため、SSH秘密鍵を使用してユーザーに接続することができます。 エクスプロイトの使用方...

Astra Linux – Vulnerability in SOX

There is a heap-based buffer overflow vulnerability in the sphere.c startread function of the Sound Exchange libsox 14.4.2 version and the main commit 42b3557e. A specially crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...

SUSE CVE-2026-48120

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...

Linux Distros Unpatched Vulnerability : CVE-2026-19025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank wh...

PT-2026-53820

RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. If a user loads a specially crafted save-file, arbitrary OS command may be executed...

CVE-2026-12018

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: High...

Google Chrome 安全漏洞

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 149.0.7827.53 contained a security vulnerability caused by improper implementations in the Extensions component. This vulnerability could allow remote attackers to exploit it through a specially crafted XML...

EUVD-2026-33100

Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Chromium security severity: High...

PT-2026-42214

Name of the Vulnerable Software and Affected Versions @cyntler/react-doc-viewer version 1.17.1 Description A Cross-Site Scripting XSS issue exists where remote attackers can execute arbitrary JavaScript by using a crafted .txt file. This occurs because the TXTRenderer component does not sanitize...

SUSE CVE-2026-8586

Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. Chromium security severity: Medium...

The vulnerability of the search function in the text editor Notepad++ allows a perpetrator to gain unauthorized access to protected information and cause service failure.

The vulnerability of the search function in the Notepad++ text editor is related to deficiencies in the formatting string processing mechanism. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information and cause service failures through a specially...

CVE-2026-41911 OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image

OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries. Attackers can exploit uploadfile and uploadimage endpoints to access files beyond the intended workspace-only filesystem policy...

The vulnerability of the Vim text editor, related to the lack of measures to neutralize special elements, allows a hacker to execute arbitrary commands.

The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands, provided that the user opens a specially crafted file...

CVE-2026-6364

Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. Chromium security severity: Medium...

MiracleLinux 8 : vim-8.0.1763-22.el8_10.1.ML.1 (AXSA:2026-423:06)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-423:06 advisory. vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin CVE-2026-28417 vim: Vim: Denial of service and information disclosure...

PT-2026-33164

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.101 Description An out of bounds read in Skia allows a remote attacker to obtain potentially sensitive information from process memory by using a crafted file. An out of bounds read occurs when a...

SUSE CVE-2026-5909

Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-24660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a...

CVE-2026-35176

CVE-2026-35176 concerns openFPGALoader (1.1.1 and earlier) with a heap-buffer-overflow in POFParser::parseSection() while parsing crafted .pof files. The issue allows out-of-bounds heap memory access and does not require FPGA hardware to trigger. Impact per data shows high severity in confidentia...