CVE-2026-9198

CVE-2026-9198 脆弱性の原因： IBM Langflow OSSは、Agent自動化ワークフローの構築とデプロイに特化したオープンソースソフトウェアです IBM Langflow OSS 1.0.0 から 1.10.0 では、自動ログイン（autologin が true）がデフォルトで有効になっています このモードでは、/api/v1/autologinエンドポイントにアクセスすると、スーパーユーザーのトークンが直接返されます このトークンを使用して、/api/v1/validate/codeエンドポイントにアクセスできます POST /api/v1/validate/co...

fuzzing

Fuzzing Forum このプロジェクトは、fuzzing に関連するチュートリアル、例、議論、研究提案、その他のリソースをホストすることを目的としています。 外部からの貢献も歓迎します。詳細については CONTRIBUTING ファイルを参照してください。 ドキュメント Why fuzz? Introduction to fuzzing What makes a good fuzz target How to split a fuzzer-generated input into parts How to write structure-aware fuzzers with...

oss-fuzz-gen

ファズターゲット生成と評価のためのフレームワーク このフレームワークは、様々な大規模言語モデル（LLM）を使用して、実際の C/C++/Java/Python プロジェクト向けのファズターゲットを生成し、OSS-Fuzz プラットフォーム を介してベンチマークします。 詳細は AI-Powered Fuzzing: Breaking the Bug Hunting Barrier で確認できます： 現在サポートされているモデルは次のとおりです： Vertex AI code-bison Vertex AI code-bison-32k Gemini Pro Gemini Ultra...

CVE-2026-9198_exploit

CVE-2026-9198 — Langflow OSS RCE no autenticado Ejecución remota de código no autenticada en IBM Langflow OSS 1.0.0 – 1.10.0 en una implementación predeterminada. Encadena dos fallos: CVE-2026-9103 — GET /api/v1/autologin emite un JWT SUPERUSER a cualquier solicitante sin credenciales cuando...

Tylium

Tylium Pipeline dati primari per rilevamento intrusioni, analisi di sicurezza e threat hunting Questi file contengono configurazioni per produrre dati EDR Endpoint Detection and Response oltre ai log di sistema standard. Queste configurazioni consentono la produzione di questi flussi di dati...

CVE-2022-44877

Usa il modulo go-exploit Quando la modalità modulo è disattivata root@kitploit: go get github.com/vulncheck-oss/go-exploit Quando la modalità modulo è attivata root@kitploit: go mod init example.com/myapp go get github.com/vulncheck-oss/go-exploit Compila root@kitploit: go build -o cve-2022-44877...

CVE-2021-21300

CVE-2021-21300 فقط استنسخني ثم ستطبع آلتك "PWNED" المرجع:https://www.openwall.com/lists/oss-security/2021/03/09/3...

bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

kekeo

kekeo kekeo è una piccola collezione di strumenti che ho iniziato per manipolare Microsoft Kerberos in C e per divertimento Libreria ASN.1 In kekeo, uso una libreria commerciale esterna per gestire le strutture ASN.1 di Kerberos: OSS ASN.1/C http://www.oss.com/asn1/products/asn1-c/asn1-c.html È...

kekeo

kekeo kekeo is a little toolbox I have started to manipulate Microsoft Kerberos in C and for fun ASN.1 library In kekeo, I use an external commercial library to deal with Kerberos ASN.1 structures: OSS ASN.1/C http://www.oss.com/asn1/products/asn1-c/asn1-c.html It was the only code...

clusterfuzz

ClusterFuzz ClusterFuzz è un'infrastruttura di fuzzing scalabile che trova problemi di sicurezza e stabilità nel software. Google utilizza ClusterFuzz per fuzzare tutti i prodotti Google e come backend di fuzzing per OSS-Fuzz. ClusterFuzz fornisce molte funzionalità che aiutano a integrare...

clusterfuzz

ClusterFuzz ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features which help seamlessly integrate fuzzing into a softwar...

oss-fuzz

OSS-Fuzz: Kontinuierliches Fuzzing für Open Source Software Fuzz-Tests sind eine bekannte Technik zum Aufdecken von Programmierfehlern in Software. Viele dieser erkennbaren Fehler, wie etwa Pufferüberläufe, können schwerwiegende Sicherheitsauswirkungen haben. Google hat Tausende von...

CVE-2026-9198

CVE-2026-9198 - IBM Langflow RCE sem autenticação via bypass de auto-login PoC educacional Este repositório fornece uma prova de conceito educacional para CVE-2026-9198 que afeta o IBM Langflow OSS. O PoC poc.py demonstra como um atacante não autenticado pode encadear: 1. GET/POST /api/v1/autolog...

CVE-2020-10204

CVE-2020-10204 CVE-2020-10204 Skript zur Remote-Befehlsausführung Weitere Skriptdateien siehe: https://github.com/zhzyker/exphub Readme root@kitploit: +---------------------------------------------------------------------------------------------------------+ + DES: by zhzyker as...

Piano LED Visualizer 1.3 - Local File Inclusion

Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. id: CVE-2022-24900 info: name: Piano LED Visualizer 1.3 - Local File Inclusion author: 0xAkoko severity: high description: | Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. impact: | An attacker...

Mlflow <2.8.0 - Local File Inclusion

Mlflow before 2.8.0 is susceptible to local file inclusion due to path traversal in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2023-6977...

Flyte Console <0.52.0 - Server-Side Request Forgery

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or...

Mlflow <2.3.1 - Local File Inclusion Bypass

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. id: CVE-2023-2780 info: name: Mlflow 2.3.1 - Local File Inclusion Bypass author: iamnoooob,pdresearch severity: critical description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1...

Mlflow - Arbitrary File Write

An attacker can overwrite any file on the server hosting MLflow without any authentication. id: CVE-2023-6018 info: name: Mlflow - Arbitrary File Write author: byt3bl33d3r severity: critical description: | An attacker can overwrite any file on the server hosting MLflow without any authentication...