CVE-2026-22003-Redis-Lua-Sandbox-Escape-via-debug.sethook-

CVE-2026-22003 – Escape del sandbox Lua de Redis mediante debug.sethook Código del programa disparador Lua + Python root@kitploit: -- redissandbox.lua - Script that attempts sandbox escape local function escape debug.sethookfunction -- This hook runs in a privileged context os.execute"id...

Shwmae

Shwmae Shwmae शुह-माई एक Windows Hello दुरुपयोग उपकरण है जिसे DEF CON 32 के दौरान "Abusing Windows Hello Without a Severed Hand" वार्ता के भाग के रूप में जारी किया गया था। इस उपकरण का उद्देश्य एक विशेषाधिकार प्राप्त उपयोगकर्ता संदर्भ से Windows Hello का दुरुपयोग करना है। root@kitploit: Shwmae...

CVE-2026-59567

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...

EUVD-2026-64883

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...

CVE-2026-59567

Zscaler Client Connector is affected by multiple local privilege escalation vulnerabilities that allow an unprivileged user to execute arbitrary code in a privileged context . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, no user interacti...

CVE-2026-73032

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM...

PT-2026-70874

Name of the Vulnerable Software and Affected Versions PapersGPT for Zotero version 0.6.1 Description A remote code execution issue exists where arbitrary JavaScript can be executed by returning malicious code from an LLM endpoint. This occurs because the response is passed unsanitized to the...

CVE-2026-72865 Dokploy: OS Command Injection via compose `composePath`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c,...

CVE-2026-45131

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow pull-request.yaml executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens...

Astra Linux – Vulnerability in Firefox and Thunderbird

If an attacker were able to corrupt the methods of an Array object in JavaScript through prototype pollution, they could have executed JavaScript code under their control in a privileged context. This vulnerability affects Firefox ESR 91.9.1, Firefox 100.0.2, Firefox for Android 100.3.0, and...

EUVD-2016-2900

Malware in sbrugna...

EUVD-2016-2926

Malware in sbrugna...

EUVD-2014-4327

Malware in sbrugna...

EUVD-2025-27073

Malicious code in bioql PyPI...

EUVD-2025-26075

Malicious code in bioql PyPI...

CVE-2025-22441

In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

PT-2025-36339

Name of the Vulnerable Software and Affected Versions: Roo Code versions 3.26.6 and below Description: Roo Code is an AI-powered autonomous coding agent. A Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to achieve Remote Code Execution RCE on...

CVE-2025-22441

In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2025-22441

In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2025-22441

In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...