CVE-2022-3168-adb-unexpected-reverse-forwards

Android Debug Bridge adb のリバーストンネル機能には、悪意のある adb デーモンがホスト上の任意のホスト/ポートおよび Unix ドメインソケットへの接続を開くことができる脆弱性がありました。 攻撃者ウィンドウ 不正なデーモンが実行されている場所: $ ./adbroguedaemon.py 被害者ウィンドウ この例では GCE VM: $ adb connect serverip:5556 connected to 8.tcp.ngrok.io:19076 攻撃者ウィンドウ: ... Wooho, we got response for our rouge...

cornershot

What is CornerShot In warfare, CornerShot is a weapon that allows a soldier to look past a corner and possibly take a shot, without risking exposure. Similarly, the CornerShot package allows one to look at a remote host’s network access without the need to have any special privileges on that host...

CVE-2026-67340_exploit

CVE-2026-67340 — ArcadeDB JAVASCRIPT トリガースクリプト RCE（認証後） ArcadeDB（Java製のマルチモデルデータベース）では、ホストクラスに到達する JAVASCRIPTトリガー を介して、認証後のリモートコード実行が可能です。 トリガーの GraalVM ポリグロットエンジンは、java.lang. を含むホストクラスの許可リストを備えて構築されています（ScriptTriggerExecutor.setAllowedPackages）。そのため、トリガースクリプトから次の呼び出しが可能です：...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor の未認証 RCE（INLINE GraalVM 評価機能経由） Conductor OSS / Orkes3.21.21 … before 3.30.2 は、GraalVM コンテキスト（完全なホストアクセス （HostAccess.ALL）で構築）を使用して、INLINE（および LAMBDA / DOWHILE / SWITCH）タスク内のユーザー提供の JavaScript を評価します。スクリプトは java.lang.Runtime までリフレクションし、OS コマンドを実行します。コミュニティ API はデフォルトで認証が...

EulerOS Virtualization 2.11.1 : wget (EulerOS-SA-2026-3481)

According to the versions of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are...

CVE-2026-92956 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...

CVE-2026-92956

vm2 versions 3.10.1 through 3.11.6 are vulnerable to a sandbox escape on Node.js 26 that requires only a default new VM() configuration. The root cause is that WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise rejecting with a host-realm error ...

CVE-2026-57138 PraisonAI codeMode sandbox escape via Function constructor

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-88001 Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user...

CVE-2026-54614 DebugKit: MailPreview contains unsafe reflection

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className to constructor...

CVE-2026-34964: Server-Side Request Forgery (SSRF)

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

EUVD-2026-63273

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool . The tool used a raw HTTP client to send requests to a user-supplied API URL, bypassing n8n's centralized SSRF protection. On instances with N8N_SSRF_PROTECTION_ENABLED=true, an authenticated ...

CVE-2026-77085: Server-Side Request Forgery (SSRF)

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

EUVD-2026-62275

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

PT-2026-78289

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

PT-2026-77240

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An issue exists where missing authorization allows an attacker with access to a mapped host to read from or write to LUNs Logical Unit Numbers, which are unique identifiers used to...