cornershot

What is CornerShot In warfare, CornerShot is a weapon that allows a soldier to look past a corner and possibly take a shot, without risking exposure. Similarly, the CornerShot package allows one to look at a remote host’s network access without the need to have any special privileges on that host...

CVE-2022-3168-adb-unexpected-reverse-forwards

Android Debug Bridge adb のリバーストンネル機能には、悪意のある adb デーモンがホスト上の任意のホスト/ポートおよび Unix ドメインソケットへの接続を開くことができる脆弱性がありました。 攻撃者ウィンドウ 不正なデーモンが実行されている場所: root@kitploit: $ ./adbroguedaemon.py 被害者ウィンドウ この例では GCE VM: root@kitploit: $ adb connect serverip:5556 connected to 8.tcp.ngrok.io:19076 攻撃者ウィンドウ: root@kitploi...

CVE-2026-67340_exploit

CVE-2026-67340 — ArcadeDB JAVASCRIPT 트리거 스크립트 RCE 인증 후 인증 후 원격 코드 실행은 ArcadeDBJava 멀티모델 데이터베이스에서 호스트 클래스에 도달하는 JAVASCRIPT 트리거 를 통해 발생합니다. 트리거의 GraalVM 폴리글랏 엔진은 java.lang.을 포함하는 호스트 클래스 허용 목록으로 구성됩니다ScriptTriggerExecutor.setAllowedPackages. 따라서 트리거 스크립트는 다음을 호출할 수 있습니다: root@kitploit:...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Неаутентифицированное RCE в Conductor через INLINE-оценщик GraalVM Conductor OSS / Orkes3.21.21 … до 3.30.2 оценивает предоставленный пользователем JavaScript в задачах INLINE и LAMBDA / DOWHILE / SWITCH с контекстом GraalVM, построенным с полным доступом к хосту HostAccess.ALL...

CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

EUVD-2026-63273

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool . The tool used a raw HTTP client to send requests to a user-supplied API URL, bypassing n8n's centralized SSRF protection. On instances with N8N_SSRF_PROTECTION_ENABLED=true, an authenticated ...

EUVD-2026-62275

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

PT-2026-77240

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An issue exists where missing authorization allows an attacker with access to a mapped host to read from or write to LUNs Logical Unit Numbers, which are unique identifiers used to...

CVE-2026-19050

The CVE concerns the ProSolution WP Client WordPress plugin prior to version 2.0.9. The underlying issue is that the plugin does not validate a user-supplied URL and does not check requester capability or nonce before performing a server-side HTTP request. This allows any authenticated user (e.g....

CVE-2026-73218

Cursor for macOS prior to 3.0.0 is vulnerable to a sandbox escape: an agent in Auto-Run Sandbox mode, with Docker Desktop and the Dev Containers CLI installed, can launch a privileged container and mount Docker’s virtiofs0. This grants read/write access to the user’s home directory and enables ho...

CVE-2026-72606

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

PT-2026-70108

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

[SECURITY] Fedora 43 Update: freeipa-4.13.2-1.fc43

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

CVE-2026-58075

A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally...

Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the request URI handling. An attacker can access resources on hosts that should have been excluded by bypassing host-based access controls through manipulation of noncanonical...

EUVD-2026-52188

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-9593

The CVE-2026-9593 entry describes a vulnerability in the iDTM FDI where an attacker with elevated privileges on the host can enable the debug interface by placing a crafted file in the application directory. This could lead to unauthorized access to connected devices and exposure, modification, o...