DriverJack

DriverJack 简介 DriverJack 是一款旨在利用鲜为人知的 NTFS 技术加载有漏洞驱动程序的工具。这些方法通过劫持现有服务绕过系统上驱动服务的注册，并且还伪造驱动加载事件中显示的镜像路径。为进一步隐藏有漏洞驱动的存在，该攻击还利用了模拟文件系统只读绕过，在加载前替换已挂载 ISO 上的驱动文件内容。 模拟文件系统只读绕过 DriverJack 利用了将挂载在模拟文件系统上的文件重新映射到读写页以覆盖其内容的可能性。此只读绕过在 IoCdfsLib 中实现。 攻击概述 一旦 ISO...

pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass

CVE-2026-17351 — pgAdmin 4 AI Assistant Read-Only Bypass via Lexer Differential PoC for CVE-2026-17351, a critical CVSS 9.0 SQL injection bypass in pgAdmin 4's AI Assistant. Vulnerability Summary pgAdmin 4 versions 9.13 through 9.16 use Python's sqlparse library to validate that LLM-generated SQL...

CVE-2026-88891

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

PT-2026-89402

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

CVE-2026-87911

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911

CVE-2026-87911 is a CRITICAL (CVSS 9.6) OS command injection vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server prior to version 1.1.7. The flaw lies in the read-only enforcement , which can be bypassed by injecting a crafted COPY ... TO PROGRAM statement into con...

CVE-2026-85788

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

EUVD-2026-75104

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-85788

CVE-2026-85788 affects the mutable SQL detector component in Amazon awslabs mysql-mcp-server . An incomplete list of disallowed inputs allows context-dependent actors to bypass the read-only enforcement gate by crafting SQL inline comments that the regex engine does not treat as whitespace, reach...

CVE-2026-85788 Incomplete list of disallowed inputs in awslabs mysql-mcp-server

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-87808

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

CVE-2026-87808

SiYuan versions prior to v3.8.2 contain an incomplete fix for CVE-2026-32767. The POST /api/search/fullTextSearchBlock endpoint, when invoked with method=2, forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a resu...

CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

dirtyCow

Dirtycow also known as CVE-2016-5195 and it's very populer vulnerability of past time. First of all choose the fitted Linux version for that vulnerability. then install or run it on VBOX or VMWare . after install it follow those instructions. 1. Create a user without having root access. 2. Log in...

Astra Linux – Vulnerability in Samba

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions, when the Samba VFS module “aclxattr” is configured with “aclxattr:ignore system acls = yes”. The SMB protocol allows opening files when the client requests read-only...

Astra Linux – Vulnerability in Linux

A issue was discovered in Linux: improper handling of VMIO|VMPFNMAP vmas in KVM can bypass RO checks and cause pages to be freed while still accessible by the VMM and guest. This allows users who have the ability to start and control a VM to read/write random pages of memory, potentially leading ...

EUVD-2026-62936

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

CVE-2026-76372

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...