CVE-2017-11610

CVE-2017-11610 Unauthenticated Reverse Shell RCE for Supervisor 3.0a1 - 3.3.2 Standalone Python ≥3.6 Unauthenticated RCE exploit for Supervisor 3.0a1 to 3.3.2, rewritten from this Metasploit module. Explanatory post here. Tested with Python 3.7 on this target runing Supervisor 3.3.2 Usage:...

HardBreacher

HardBreacher Kaspersky Antivirus For Endpoint のゼロデイ権限昇格の脆弱性 この問題は今やMicrosoftの外にも漏れ出しています。ホーム版か商用版のどちらかにバグを見つけるかという投票が行われ、投票結果は商用版となりました。 これを書いている時点で、この概念実証は完全にパッチが適用されたWindows 11 25H2とKaspersky for Endpoint v14.0.0.504で動作します。...

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into...

CVE-2026-77339

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or...

CVE-2026-77339 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or...

CVE-2026-77339 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or...

CVE-2026-77339

Process Compose (a scheduler and orchestrator for non-containerized applications) had a vulnerability in its MCP SSE listener (src/mcp/server.go) prior to version 1.120.0 . The listener accepted browser-origin requests to /sse and the returned message endpoint without validating the Host or Origi...

CVE-2026-77339: Missing Authentication for Critical Function

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or...

CVE-2026-16526

A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root...

PT-2026-66363

Name of the Vulnerable Software and Affected Versions PCP affected versions not specified Description A flaw in the linux sockets module exposes an unsecured internal connection. An attacker who has already achieved initial code execution can exploit this weakness to escalate privileges and execu...

CVE-2026-49414

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user ca...

Hitachi Energy RTU500

SUMMARY Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. If exploited, these vulnerabilities primarily impact product availability, with potential secondary impacts on confidentiality and integrity. Please refer to the Recommended Immediate...

CVE-2026-26945

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain a Process Control vulnerability. A high privileged attacker with adjacent...

CVE-2026-26945

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain a Process Control vulnerability. A high privileged attacker with adjacent...

CVE-2026-26945

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain a Process Control vulnerability. A high privileged attacker with adjacent...

CVE-2026-26945

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain a Process Control vulnerability. A high privileged attacker with adjacent...

CVE-2026-26945

Dell Integrated Dell Remote Access Controller (iDRAC) 9/14G versions prior to 7.00.00.181, iDRAC 9 15G/16G prior to 7.20.10.50, and iDRAC 10, 17G prior to 1.20.25.00 contain a Process Control vulnerability. A high-privilege attacker with adjacent network access could potentially exploit this vuln...

PT-2026-26132

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain a Process Control vulnerability. A high privileged attacker with adjacent...

CVE-2026-26945: Process Control

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain a Process Control vulnerability. A high privileged attacker with adjacent...

OpenClaw's config env vars allowed startup env injection into service runtime

Summary OpenClaw allowed dangerous process-control environment variables from env.vars for example NODEOPTIONS, LD, DYLD to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context. Details collectConfigEnvVars accepted unfiltered keys...