PT-2026-89138

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

linux-privilege-escalation

Linux 権限昇格 CVE-2022-0847 の Linux "Dirty Pipe" 脆弱性をチェックし、悪用するBashスクリプト この Proof of Concept について このスクリプトを使用すると、脆弱性のあるシステム上の権限のないユーザーは以下を行うことができます: /etc/passwd のような 読み取り専用 ファイルを変更/上書きします。 昇格したシェルを取得します。 このリポジトリには2つのエクスプロイトが含まれています: エクスプロイト 1: ルートパスワードを "piped" というパスワードに置き換え、元の /etc/passwd ファイルを...

CVE-2026-9090-Modbus-TCP-Write-to-Read-Only-Coils-via-Function-Code-Spoofing

CVE-2026-9090 – ファンクションコード偽装によるModbus TCP読み取り専用コイルへの書き込み プログラムコード（pymodbusを使用したPythonシミュレーション） root@kitploit: modbusplcsim.py - Simulated Modbus PLC with read‑only coils from pymodbus.server.sync import StartTcpServer from pymodbus.device import ModbusDeviceIdentification from pymodbus.datastore...

Exploit-Dirty-Cow

エクスプロイト - Dirty Cow CVE-2016-5195 権限昇格ラボ | Linuxカーネルエクスプロイト 📋 概要 DirtyCow脆弱性CVE-2016-5195を再現する実践ラボです。これはLinuxカーネルに見られる重大な競合状態で、 特権のないユーザーが読み取り専用メモリマッピングへの書き込みアクセスを取得し、完全なroot権限昇格につながります。 🎯 目的 カーネルレベルで競合状態がどのように悪用されるかを理解する 管理された環境で現実の権限昇格攻撃を再現する エクスプロイトの動作を分析し、緩和策を文書化する 🛠️ ツールと環境 Kali Linux...

CVE-2022-0847-dirty-pipe-checker

CVE-2022-0847-dirty-pipe-checker CVE-2022-0847をチェックするBashスクリプト Dirty Pipe 概要 これはCVE-2022-0847の話です。Linuxカーネル5.8以降の脆弱性で、任意の読み取り専用ファイルのデータを上書きできるものです。これにより、非特権プロセスがルートプロセスにコードを注入できるため、権限昇格が発生します。 これはCVE-2016-5195「Dirty Cow」に似ていますが、より悪用が容易です。 この脆弱性はLinux 5.16.11、5.15.25、5.10.102で修正されました。 使用方法 最初...

dirtypipe

reF: https://access.redhat.com/security/vulnerabilities/RHSB-2022-002 诊断 已开发出一个漏洞检测脚本，用于确定您的系统当前是否受到此漏洞的影响。要验证脚本的真实性，您还可以下载分离的 OpenPGP 签名。有关如何使用 GPG 签名进行验证的说明，可在客户门户网站中找到。 常见问题 问：此漏洞如何修改只读内容？ 答：当文件被访问时，它会加载到内存的“缓存”区域（页面缓存），攻击者能够更改缓存内存中的文件内容。因此，后续对文件的读取将返回被篡改的内容。 问：此漏洞是否会损坏磁盘上实际文件的内容？...

EUVD-2026-72946

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

CVE-2026-82059

CVE-2026-82059 affects MongoDB Server , where an internal aggregation expression was incorrectly exposed to any authenticated user instead of being restricted to internal cluster operations. An attacker with read-only privileges can craft a malformed index specification within this expression to ...

CVE-2026-86544

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent...

CVE-2026-86493

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...

CVE-2026-86493

JetBrains YouTrack versions before 2026.2.18634 contained improper permission checks that allowed read-only users to create and modify whiteboard cards . This represents an authorization bypass with an integrity impact — a user granted only read access could alter content without being permitted ...

CVE-2026-86493

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...

EUVD-2026-72509

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...

CVE-2026-86493

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...

CVE-2026-86487

In JetBrains YouTrack versions before 2026.2.18634 , a crafted WebSocket message allowed read-only whiteboard users to modify canvas content. The flaw is an integrity issue: users who should have had read-only access could alter whiteboard drawings. The CVSS 3.1 score is 3.1 (LOW) , reflecting a ...

PT-2026-86937

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent...

PT-2026-86738

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053396)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053396 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqipriv When mounting ocfs2 and then...

EUVD-2026-71748

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

EUVD-2026-70667

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...