Super-UEFIinSecureBoot-Disk

Super UEFIinSecureBoot Disk Super UEFIinSecureBoot Disk is a proof-of-concept not actively maintained or enhanced bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives. Key feature: disk is fully functional with UEFI Secure Boot mode activated. It can...

CVE-2025-62506

CVE-2025-62506 Vulnerability Verification Script Overview This repository contains a verification script for CVE-2025-62506, a privilege escalation vulnerability in MinIO service accounts and STS Security Token Service accounts. Vulnerability Description CVE-2025-62506 is a privilege escalation...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE This PoC demonstrates how an attacker can chain Orange Tsai's CVE-2024-4577 with DNS rebinding to achieve remote code execution on internal network infrastructure directly through the victim’s web browser. By bypassing Same-Origin Policy SOP and exploiting vulnerable PHP-CGI...

CVE-2024-0311

CVE-2024-0311 ? This is a PoC for what I believe is CVE-2024-0311, SB10418. A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. Much details. Very exploit. ¯\ツ /¯ The PoC injects into a user-ran SCPBypass.exe process and writes to the...

Metasploit-Module-TFM

Custom Metasploit Module for CVE 2023-2728 and CVE 2024-3177 Description This custom module exploits CVE 2023-2728 and CVE 2024-3177 in Kubernetes versions that are vulnerables to each of them e.g. v1.27.2 is vulnerable to both, both related to bypassing the imposition of the mountable secrets...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — Same-Origin Policy bypass via cross-port interception CVE-2026-20643 | ---|--- CVE| CVE-2026-20643 Discovered by| Thomas Espach WebKit Bugzilla 306050 Component| WebKit — WebCore::Navigation::innerDispatchNavigateEvent Affected| iOS 26.3.1...

CVE-2026-109772

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the DevTools component...

CVE-2026-62201-OpenClaw-SSRF

CVE-2026-62201 — OpenClaw Sandbox Exec-Server Network Policy Bypass SSRF Severity: High · CVSS: 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · CWE-918 Server-Side Request Forgery Vulnerability at a Glance Field| Value ---|--- Advisory| GHSA-mgvr-6gvw-3rgr NVD| CVE-2026-62201 Product| OpenClaw...

CVE-2026-119331

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

CVE-2019-14287-IT18030372-

CVE-2019-14287-IT18030372- Sudo Security Policy bypass Vulnerability...

CVE-2026-119331 Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

CVE-2026-119331 Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

EUVD-2026-114394

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

CVE-2026-119331

The Ladybird web browser is vulnerable to a Same-Origin Policy bypass due to missing origin-clean flag enforcement. Specifically, the CSSStyleSheet.cssRules, insertRule(), and deleteRule() functions in Libraries/LibWeb/CSS/CSSStyleSheet.cpp failed to trigger a SecurityError when handling cross-or...

CVE-2026-119287 Zuke: Command-form registry descriptors bypass the MCP launch policy

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2026-119287 Zuke: Command-form registry descriptors bypass the MCP launch policy

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

Digisol-DG-GR1321-s-Password-Policy-Bypass-CVE-2024-2257

Digisol-DG-GR1321-s-Password-Policy-Bypass-CVE-2024-2257...

Security Bulletin: Vulnerability in InformixHQ

Summary Upgrade to InformixHQ 3.3.3 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normaliz...

Sudo-Vulnerability-Exploit-CVE-2019-14287

Sudo-Vulnerability-Exploit-CVE-2019-14287 Sudo has been discovered to be unreliable, one of the most significant, powerful, and commonly used utilities installed in almost any Unix and Linux based operating system as a simple command. A pseudo security policy bypass flaw that allows arbitrary...

CVE-2026-118767

A flaw was found in Botan. Its Python bindings fail to properly reject embedded null characters when converting strings, causing bcrypt password hashing functions to truncate the input at the null byte. A remote attacker can exploit this flaw to bypass password length and complexity policies, as ...