lamda

FIRERPA Android ｜ AI 기반 자동화 온디바이스 서비스, AI 지원 에이전트, 확장 가능한 도구 호출을 하나로 결합한 올인원 Android 자동화 프레임워크입니다. 문서 | 使用文档 | TELEGRAM | QQ 그룹 | SKILLS | llms-full.txt | 中文版本 FIRERPA는 올인원 Android 기기 제어 플랫폼 입니다. 서버가 기기에서 직접 실행되며 추가 런타임 의존성이 필요 없습니다. 여러 세대의 Android를 지원 하고 루트 유무와 관계없이 동작합니다. PC 측에서는 Python 클라이언트...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

dirtyCow

DirtycowはCVE-2016-5195としても知られ、過去の非常に有名な脆弱性です。 まず、その脆弱性に適したLinuxバージョンを選択してください。次に、VBOXまたはVMWareにインストールまたは実行します。インストール後、以下の手順に従ってください。 1. rootアクセス権のないユーザーを作成します。 2. 作成したユーザーにログインします。 3. ディレクトリを作成します。 4. ‘.txt’ドキュメントにrootアクセス権を作成し、読み取り専用権限を付与します。 5. ‘.txt’ファイルが作成された場所で‘.c’ファイルをコンパイルして実行します。 6...

CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

EUVD-2026-78823

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

CVE-2026-79705

CVE-2026-79705 affects the buildah/copier Go package, which underpins podman cp operations. When the copier is used outside of Buildah by a non-root caller , a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destin...

CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

rapid7-CVE-2026-15409

CVE-2026-15409 이 저장소는 CVE-2026-15409에 대한 개념 증명 익스플로잇을 포함합니다. 이는 localhost:1050에서 예상되는 Erlang 프로토콜을 구현하고 이를 웹소켓을 통해 터널링하여 파일 읽기/쓰기 및 RPC 호출을 통한 임의 코드 실행을 가능하게 함으로써 SonicWall SMA 1000에서 비-root 원격 코드 실행을 수행합니다. 사용법 root@kitploit: python3 cve-2026-15409.py --ws-url...

Astra Linux – Vulnerability in Tomcat9

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted elsewhere beyond the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not protected by the...

Astra Linux – Vulnerability in open-vm-tools

open-vm-tools contains a file descriptor hijacking vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor, allowing them to simulate user inputs...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A flaw was discovered in the Linux kernel. The existing KVM SEV API contains a vulnerability that allows a non-root host user-level application to crash the host kernel by creating a confidential guest VM instance in an AMD CPU that supports Secure Encrypted Virtualization SEV...

EUVD-2026-51988

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-68578 ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-68578

ArcadeDB before 26.7.3 is affected by an authentication bypass in the MCP HTTP transport: the server does not bind the authenticated principal, causing engine permission checks to pass as no-ops. As a result, non-root MCP-allowed users can perform arbitrary writes, DDL, schema mutations, and run ...

CVE-2026-68563

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

CVE-2026-68563

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

Linux Distros Unpatched Vulnerability : CVE-2026-68563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is...

GHSA-P279-2CQP-84JG OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...

SUSE CVE-2026-63892

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...

SUSE-SU-2026:3124-1 Security update for microcode_ctl

This update for microcodectl fixes the following issue: - CVE-2025-35979: shared microarchitectural predictor state in VMX non-root operation could lead to data leaks bsc1265189. Changes for microcodectl: - Intel CPU Microcode was updated to the 20260512 release bsc1265189: Update for various...