hush

Give your agents boundaries you can read. Get decisions you can verify. What · Quickstart · How it works · SDKs · CLI · Policies · Docs · Spec What is HushSpec? HushSpec is an open specification for the security controls an AI agent operates under. Write a policy in YAML, evaluate it in Rust,...

cve-2025-9074-poc

CVE-2025-9074 Educational PoC / Proof of Concept Code This repository contains a PoC for educational purposes that demonstrates the risk of exploiting Docker Engine's unauthenticated remote API to create a privileged container with read/write access to the host filesystem. The executable file is...

CVE-2020-11651-PoC

CVE-2020-11651-PoC Repository that contains a CVE-2020-11651 Exploit updated to work with the latest versions of python and handle the errors with the connections. README COPY FROM THE ORIGINAL REPOSITORY Original Repository PoC exploit for CVE-2020-11651 and CVE-2020-11652 This is a proof of...

CVE-2020-11651-poc

CVE-2020-11651 および CVE-2020-11652 の PoC エクスプロイト これは、最初の チェックスクリプト に基づく概念実証エクスプロイトです。Salt マスターサーバーが 必要な修正を含むリリース に正常に更新されたことを確認するために使用します。 F-Secure Labs の調査と報告に感謝します。 現在、このスクリプトはマスターと接続されているすべてのミニオン上でファイルシステムへのアクセスやコマンドのスケジュールに使用できます。これらの力を賢く使いましょう！ 使い方 デフォルトの操作（引数なし）は、指定されたマスターのルートキーを取得します。...

CVE-2024-21626

CVE-2024-21626 エクスプロイト 作業ディレクトリ docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm 重要なのは -w /proc/self/fd/8 を指定することです\ コンテナ内で cat ../../../../../../../../../etc/passwd を実行して、ホストのファイルシステムにアクセスします エクスプロイト シンボリックリンク 1. docker run --name cve-2024-21626 --rm --it...

CVE-2025-32463

🚨 PoC: CVE-2025-32463 – Sudo chroot Escape Vulnerability A critical vulnerability affecting sudo versions 1.9.0 to 1.9.17p1 , allowing users to escape from chroot and gain access to the real root filesystem. 📌 Description CVE-2025-32463 is a local privilege escalation vulnerability in sudo that...

cve-2024-21626

CVE-2024-21626 概要 このリポジトリには、CVE-2024-21626に対して脆弱なアプリのコード例と、悪用試行を検出するためのeBPFガジェットが含まれています。 このリポジトリは、このブログ記事の一部として作成されました。 この脆弱性の検出に使用されるガジェットプログラムは、デモンストレーション目的のみです。これはCVE-2024-21626の完全な検出ではありません。 脆弱性の説明...

Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

EUVD-2026-81607

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1789979782)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789979782 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_61383)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661383 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via HTTP...

Rocky Linux 10.2 [CIQ] Security Update: nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc Multiple Vulnerabilities (crlsa-2026_61377)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661377 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

Rocky Linux 10.2 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-devel / nodejs-docs / etc Multiple Vulnerabilities (crlsa-2026_61376)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661376 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_61386)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661386 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via HTTP...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_62219)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662219 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via HTTP...

cve-2021-41773-exploration

Overview CVE-2021-41773 is a path traversal vulnerability discovered in Apache HTTP Server 2.4.49 in October 2021. The root cause was a failure to properly normalize dot sequences ended into the URL before checking whether requested path stayed within the web root. This vulnerability allowed an...

CVE-2026-88899

CVE-2026-88899 - Knowns 0.30.0 Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem Overview An improper authorization and header-spoofing vulnerability was reported regarding Knowns' reverse proxy for an embedded OpenCode AI agent daemon...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746188134)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746188134 advisory. - A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host...

AlmaLinux 8 : nodejs:22 (ALSA-2026:62219)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62219 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

CVE-2026-78122-POC

CVE-2026-78122 — Proof of Concept Tecnativadocker-socket-proxy ≤ 0.5.0 — Insufficient Access-Control Granularity CWE-1220 CVSS 4.0: 8.3 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Attack Vector is Adjacent AV:A: the attacker needs local/adjacent network reach to the pro...