CVE-2021-22214

CVE-2021-22214 Gitlab CI Lint API未授权 SSRF漏洞 CVE-2021-22214 本文以及工具仅限技术分享，严禁用于非法用途，否则产生的一切后果自行承担。 Usage help $ python3 gitlabssrf.py =============================================================== / | | | | | / / | | | | | | || | | | | | | | | | | | | | | | | / | ' \ \ \ | /| | | || | | || || | | |...

sshconfig-lint

sshconfig-lint 一个引擎，适用于 SSH 配置发生变更的所有场景。 sshconfig-lint 可发现 OpenSSH 客户端配置中的语义错误：重复主机、损坏的身份文件路径、不安全选项、弱算法、通配符顺序以及错综复杂的 Include 链。在本地、Git 钩子、GitHub Actions 和编辑器中均可使用相同的规则代码。 试用私有浏览器演练场 · 通过交互式示例学习 · 阅读所有规则 浏览器检查器在您的设备上运行。配置内容不会被上传，也不会收集任何遥测数据。 快速开始 check /.ssh/config sshconfig-lint check one or mor...

nray

nray Overview Nray is a free, platform and architecture independent port and application layer scanner. nray runs in a distributed manner to speed up scans and to perform scans from different vantage points. Event-based results allow to further process information during the scan, e.g. using tool...

CVE-2021-22214

CVE-2021-22214 Descripción - PoC para CVE-2021-22214: Vulnerabilidad SSRF sin autenticación en Gitlab CI Lint API - Creado por antx el 2021-11-01. Detalle - Cuando las solicitudes a la red interna para webhooks están habilitadas, una vulnerabilidad de falsificación de solicitudes del lado del...

GitLab-SSRF-CVE-2021-22214

CVE-2021-22214 POC para CVE-2021-22214: SSRF en Gitlab Descripción La instalación remota de GitLab contiene una vulnerabilidad de falsificación de solicitudes del lado del servidor SSRF como resultado de que la red interna para webhooks está habilitada. Un atacante remoto no autenticado puede...

OPENSUSE-SU-2026:11856-1 ansible-lint-26.9.0-1.1 on GA media

These are all security issues fixed in the ansible-lint-26.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

Astra Linux – Vulnerability in Ruby-Rack

A sequence injection vulnerability exists in Rack versions 2.0.9.1, 2.1.4.1, and 2.2.3.1. This vulnerability could allow for shell escapes in the Lint and CommonLogger components of Rack...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85674

aider (aider-chat) is a CLI-based AI coding assistant that automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), both of which are e...

EUVD-2026-71130

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85674: Improper Control of Generation of Code

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

sshconfig-lint v0.5.0

sshconfig-lint One engine for every place your SSH config changes. sshconfig-lint finds semantic mistakes in OpenSSH client configs: duplicate hosts, broken identity paths, unsafe options, weak algorithms, wildcard ordering, and tangled Include chains. Use the same rule codes locally, in Git hook...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204

Ghostwriter through version 7.2.6 is missing per-object authorization on its report template lint endpoints . The underlying cause is that RoleBasedAccessControlMixin.test_func only checks request.user.is_active unless a view explicitly overrides it, and neither the lint endpoint nor the stored-l...

EUVD-2026-64679

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204: Missing Authorization

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

PT-2026-79797

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test func returns only request.user.is active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kuma, stakater-reloader, delve, continuity, grafana-alloy, newrelic-nri-kube-events, nri-couchbase, argo-events, dapr, hcloud, pgpool2exporter, kube-vip, terraform-provider-acme, crossplane-provider-azure-managedidentity, cert-manager-webhook-pdns, helm,...