CVE-2026-53495

containerd on Linux with the CRI plugin enabled is affected by a goroutine leak in drainExecSyncIO (internal/cri/server/container_execsync.go). When exec probes or lifecycle hooks launch long-lived background child processes that retain stdin/stdout pipes, the input/output drain phase—lacking a d...

CVE-2026-53495 containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

CVE-2026-53495

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

EUVD-2026-77684

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

CVE-2026-53495 containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

CVE-2026-27495

CVE-2026-27495 — n8n JS Task Runner サンドボックスエスケープ ホストレルムのオブジェクトリークを通じた n8n JavaScript Task Runner のサンドボックスエスケープ。...

CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

OESA-2026-3864 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass...

OESA-2026-3727 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A vulnerability was discovered in the...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses

A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak p...

CVE-2021-39174-PoC

CVE-2021-39174-PoC Cachet設定漏洩ダンパー。CVE-2021-39174 PoC。...

CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection

CVE-2026-9997 – DHCPオプションインジェクションによるVPNスプリットトンネリングバイパス プログラムコード（PythonによるDHCPサーバー＋クライアントのシミュレーション） root@kitploit: !/usr/bin/env python3 roguedhcpserver.py - Injects a static route to bypass VPN split tunnel import socket, struct, threading def senddhcpofferclientmac, offerip: Craft a DHCP OFFER...

CVE-2026-82437

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2023-34965

CVE-2023-34965 SSPanel UIMは、Shadowsocks / V2Ray / Trojanプロトコル向けに特別に設計された多目的代理サービス販売管理システムです。2023.3より前のバージョンのSSPanel-Uimでは、/link/インターフェースへのアクセスが制限されておらず、ユーザーのサブスクリプション情報が漏洩する可能性があります。 詳細：https://github.com/AgentY0/CVE-2023-34965/blob/main/CVE-2023-34965.pdf...

CVE-2016-6415-BenignCertain-Monitor

CVE-2016-6415-BenignCertain-Monitor VirtueSecurity의 benigncertain-monitor를 재구현한 것입니다. 원본과 동일한 페이로드 옵션을 모두 갖추지는 않았지만, 필요에 따라 확장할 수 있는 Ross Bradley의 더 나은 개념 증명으로 bc-id 바이너리를 대체합니다. 크레딧: 원본 모니터는 VirtueSecurity가 작성 및 유지 관리합니다: https://github.com/VirtueSecurity/benigncertain-monitor 버그가 있는 "bc-id" 바이너...

cve-2022-21877

POC CVE-2022-21877 このリポジトリは、STAR Labsで働くQuang Linhによって発見されたCVE-2022-21877のPOCを含んでいます。これはspaceport.sysドライバ内で見つかった情報漏洩です。 付属のブログ記事はこのアドレスで見つけられます。 使用方法 POCをビルドするには、.\buildを実行するだけです。 実行するには、Tierを取得できるプールが必要です。私のテストでは、これは少なくとも2つのストレージプール（最初のプールともう1つ）が必要であることを意味します。最初のプールにはTierをアタッチできないからです。...

EUVD-2026-77488

Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry: request cleanup removed the request from its queue, and the shutdown path drained queues, but the queue object and its map...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: デスクトップヒープにおけるQWORD一つ分の過剰 Windows 11 Insiderビルド 10.0.28020.2149 において、Win32kデスクトップヒープのユーザーモードマッピングが、オフセット 0x100 に生のカーネルセッションプールポインタを露出していました。 この読み取り自体は、ほぼ攻撃的に小さなものです: root@kitploit: ULONG64 leaked = ULONG64 desktopheap + 0x100; 私のテストセッションでは、次の値が返されました: root@kitploit:...

CVE-2017-8225-EXPLOIT

CVE-2017-8225 - GoAhead System.ini の情報漏えい この脆弱性は、Wireless IP Camera P2P WIFICAM デバイスに関連します。重要な認証情報を格納する .ini ファイルの検証が正しく行われないことに起因します。熟練した攻撃者は、URI 内の loginuse および loginpas パラメータの両方に空の値を指定することで、この脆弱性を悪用できます。具体的には、パス /system.ini?loginuse&loginpas を介してアクセスが許可されます。 エクスプロイトの詳細...