6658 matches found
CVE-2026-89538
A flaw was found in the Linux kernel's Server Unix Remote Procedure Call SUNRPC component. A remote attacker, with a valid Generic Security Service GSS context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" ec field. This improper handling of malformed toke...
Alfred
WIP - 改进版 Alfred 2.0 Alfred - 模块化侦察与利用框架 实验阶段 Alfred 是一个基于 Python 的框架，旨在协助执行各种侦察、利用和后渗透任务。它具有高度模块化特性，允许用户轻松添加插件以扩展功能。该框架支持运行独立插件、处理插件参数以及跟踪执行结果。 特性 插件系统 ：轻松加载和执行自定义插件。 模块化设计 ：通过创建或导入新插件来扩展功能。 基于NLP的输入处理 ：插件通过自然语言处理理解用户输入，利用语义解析将用户意图映射到特定操作。 encorewebsm - 用于分词和句子分割 all-MiniLM-L6-v2 -...
PYSEC-2026-3971 PyTorch Lightning denial of service vulnerability
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...
CVE-2026-87542
A flaw was found in chromium-browser. This vulnerability, a 'use after free' error in the input handling, allows a remote attacker to execute arbitrary code. By enticing a user to visit a specially crafted HTML page, an attacker could bypass security measures and run malicious code within the...
CVE-2024-23113
CVE-2024-23113 该脚本用于检测 CVE-2024-23113，这是一个 FortiGate FGFM 服务（FortiGate 到 FortiManager 协议）中的格式字符串漏洞，该服务运行在 TCP 端口 541 上。漏洞产生的原因在于攻击者可以控制一个格式字符串，这可能导致远程代码执行（RCE）或其他非预期行为。FGFM 服务允许 FortiGate 设备与 FortiManager 之间进行配置管理通信，未修补版本对输入处理不当，从而易受格式字符串攻击。 脚本工作原理 1. 网络连接建立 ： 脚本首先与目标主机的 541 端口建立 SSL/TLS 连接。 它使用...
CVE-2026-78550
The Okta Access Gateway management console is vulnerable to improper input handling in its exception handler . During an authenticated administrator SSH session, user-supplied input is passed to eval() without sanitization, resulting in arbitrary code execution with the privileges of the manageme...
-CVE-2024-45352
🚨 CVE-2024-45352 – 小米智能家居远程代码执行（RCE） 📌 摘要 在小米智能家居（Xiaomi Smarthome）应用中发现了一个严重漏洞（CVE-2024-45352），由于内部 API 解析器的输入处理不当，允许未经身份验证的远程代码执行（RCE）。本地网络中的攻击者可利用此漏洞在受影响系统上执行任意命令。 🛡️ CVE 编号 CVE： CVE-2024-45352 CVSS（估计值）： 8.8（高危） 攻击向量： 网络 攻击复杂度： 低 所需权限： 无 用户交互： 无 🧪 概念验证（PoC） 以下 PoC 通过向小米智能家居本地 API 发送恶意构造的请求来演示...
NextJS-CVE-2025-29927
这是为您 GitHub 仓库准备的一份简洁且信息丰富的 README.md，它说明了这是一个针对 CVE-2025-29927 的易受攻击的 Next.js 应用程序，并包含指向您设置视频的 YouTube 链接： 🔓 NextJS-CVE-2025-29927 - 易受攻击的演示应用 这是一个易受攻击的 Next.js 应用程序 ，用于演示 CVE-2025-29927 ——在使用 Next.js 且存在不当输入处理或访问控制缺陷的 Web 应用程序中发现的一个安全漏洞。 该项目使用 MySQL 后端和 JWT 身份验证，仅用于教育和测试目的...
CVE-2026-85303
CVE-2026-85303 affects the Booking and Rental Manager WordPress plugin by Magepeople inc. , with a Stored XSS vulnerability present in versions from unspecified through 2.7.7 . The flaw stems from improper neutralization of input during web page generation, allowing an attacker with low privilege...
CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2026-84357
An improper input validation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523208474 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produc...
CVE-2026-19472
A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...
CVE-2026-15917
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...
CVE-2026-79248
Incorrect authorization in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
The vulnerability of the Audio/Video component in Firefox ESR, Firefox, and the Thunderbird email client allows a hacker to trigger a service failure.
The vulnerability of the Audio/Video component in Firefox ESR, Firefox, and the Thunderbird email client is related to improper handling of certain physical or natural conditions. Exploiting this vulnerability can allow an attacker to cause service failures...
MINI-WWXC-G58X-C8RQ
Bulletin has no description...
USN-8652-1 libvirt vulnerabilities
It was discovered that libvirt incorrectly handled guest reboots in the libxl driver. An attacker in a guest could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2021-4147 Alexander Kuznetsov discovere...
MINI-GPFQ-6JX6-7R2W
Bulletin has no description...
