CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113

CRI-O is vulnerable in its container-creation environment-variable handling (mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/container_create.go). When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to the target OCI image's confi...

CVE-2021-43617

CVE-2021-43617 Questa è una riproduzione della vulnerabilità PHP Laravel 8.70.1 - Cross Site Scripting XSS to Cross Site Request Forgery CSRF Descrizione La vulnerabilità sfrutta il fatto che possiamo bypassare la funzionalità di caricamento di file immagine di Laravel per caricare file arbitrari...

process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

WordPress-RCE-CVE-2019-8942

WordPress Crop Image RCE — CVE-2019-8942 / CVE-2019-8943 प्रमाणित WordPress क्रॉप-इमेज शोषण श्रृंखला का Python3 कार्यान्वयन। यह रिपॉजिटरी दो स्वतंत्र कार्यप्रवाहों के आसपास आयोजित की गई है: एक मैन्युअल OSCP-शैली स्क्रिप्ट और एक पूरी तरह से स्वचालित स्क्रिप्ट जिसमें एक एकीकृत रिवर्स-शेल हैंडलर है।...

vboxdie-cracker

Virtual Box Disk Image Encryption password cracker Requirements 1. PHP = 5.5.0 2. OpenSSL = 1.0.1 XTS support Algorithm description User password is stored using a combination of PBKDF2 and AES-XTS as following shown values are fixed at the moment, but they can be controlled inside the file forma...

imago-forensics

imago-forensics 🕵️ Imago is a python tool that extract digital evidences from images recursively. This tool is useful throughout a digital forensic investigation. If you need to extract digital evidences and you have a lot of images, through this tool you will be able to compare them easily. Imago...

Octopii

Octopii root@kitploit: ⠀⠀⠀⠀⠀⠀⠀⣤⣤⣄⣀⡀⠀⠀⠀⢀⣠⣤⣤⣄⡀⠀⠀⠀⢀⣀⣠⣤⣤⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠸⣿⣿⡿⠿⢿⣷⡄⢠⣿⣿⣿⣿⣿⣿⡄⢀⣾⡿⠿⢿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠈⠉⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⣠⣤⡀⠀⠀⠀⠀⠀⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠀⠀⠀⠀⠀⢀⣤⣄⠀⠀⠀ ⠸⣿⣿⣿⣿⣿⣿⣿⣿⣦⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⣴⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀ ⠀⠉⠉⠁⠀⠀⠀⠀⣿⣿⠀⢸⣿⡇⠀⠉⣿⣿⣿⣿⠉⠀⢸⣿⡇⠀⣿⣿⠀⠀⠀⠀⠈⠉⠉⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣀⣈⣻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣟⣁⣀⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀...

Sakai Profile Image Deletion has an IDOR

Summary The Sakai REST API endpoint DELETE /api/users/userId/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId i...

CVE-2025-65676

CVE-2025-65676 Vulnerabilità di Stored Cross-Site Scripting XSS in Classroomio LMS 0.1.13 consente ad attaccanti autenticati di eseguire codice arbitrario tramite immagini di copertina SVG appositamente create. Scoperta da - Rivek Raj Tamang RivuDon, Sikkim, India. Prodotto interessato: Classroom...

CVE-2025-25163

CVE-2025-25163 Plugin A/B Image Optimizer = 3.3 - Authentifizierter Abonnent+ Beliebiger Datei-Download Beschreibung Das Plugin A/B Image Optimizer für WordPress ist in allen Versionen bis einschließlich 3.3 anfällig für Directory Traversal. Dadurch können authentifizierte Angreifer mit Zugriff a...

CVE-2023-40600

CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - Nicht authentifizierte Offenlegung sensibler Informationen über Debug-Log Beschreibung Das EWWW Image Optimizer Plugin für WordPress ist in allen Versionen bis einschließlich 7.2.0 über die Funktion debuglog anfällig für die Offenlegung sensibler...

witcher

witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install root@kitploit: $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image root@kitploit: $ git clone [email protected]:mf-labs/witcher.gi...

CVE-2026-44517

A flaw was found in Buildah. Insecure handling of temporary directories and symlinks during the image build process, specifically within TempDirForURL, downloadToDirectory, and stdinToDirectory functions, allows a malicious server supplying a Git repository or tar archive to cause files outside t...

nginx-cve-fix

Nginx CVE Fix - Aus dem Quellcode erstelltes Drop-in für nginx:1.25-bookworm Ein aus dem Quellcode erstelltes nginx 1.25.5 Container-Image, das zwei CVE-Korrekturen aus dem offiziellen nginx:1.25-bookworm-Image behebt, während das Upstream-Laufzeitverhalten erhalten bleibt...

CVE-2026-66916

Bypass de Categoria Protegida por Senha via Formato JSON no JoomGallery JoomGallery ≤ 4.3.0-stable — Atacante Não Autenticado Contorna o Portão de Senha para Baixar Imagens Protegidas RESUMO Existe um bypass de controle de acesso não autenticado na visualização JSON de categorias do JoomGallery...

CVE-2026-66917

IDOR + XSS المخزّن عبر كسر التفويض على مستوى الكائن في JoomGallery JoomGallery ≤ 4.3.0 — مستخدم بدور المحرر يختطف أي صورة في المعرض ويخزّن حمولة XSS، مما يتيح الاستيلاء على جلسة المسؤول الملخص تتحقق الدالة UserimageController::save في JoomGallery من checkACL'edit', ... بدلاً من checkACL'edit.own'...

EUVD-2026-65004

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

CVE-2026-78465

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently larg...