2418 matches found
Astra Linux – Vulnerability in Node.js
A OS command injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check. This vulnerability can be easily exploited, as the IsIPAddress function does not properly check whether an IP address is invalid before making DBS requests, thereby...
PT-2026-91442
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. From 0.17.0 until 0.22.0, validate url for ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is...
CVE-2026-89635
In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
Summary In SSE/HTTP transport mode, mysqlmcpserver constructs SseServerTransport without passing securitysettings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service...
CVE-2026-89635
CVE-2026-89635 is a use-after-free vulnerability in ksmbd , the Linux kernel's SMB server component. In ksmbd_reopen_durable_fd(), when a session reconnects with a durable-v2 handle, the code incorrectly rebinds all detached oplocks on the same inode to the reconnecting session, not just the one ...
CVE-2026-89635 ksmbd: only rebind the reopened file's own oplock on durable reconnect
In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...
EUVD-2026-76547
In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...
CVE-2026-89635
In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...
smbtakeover
smbtakeover 一种在 Windows 上解除绑定并重新绑定 445/tcp 的技术，无需加载驱动程序、无需向 LSASS 加载模块，也无需重启目标机器。实现该技术是为了减轻在 C2 操作过程中基于 SMB 的 NTLM 中继负担。该技术的技术分析在 x33fcon 上的演讲 Relay Your Heart Away: An OPSEC Concious Approach to 445 Takeover 中有更详细的讨论。 PoC 以 Python 和 BOF 两种格式编写。两者在针对远程机器时都使用基于 TCP 的 RPC（ncacniptcp）作为传输方式。 操作使用说明...
PT-2026-90533
Summary In SSE/HTTP transport mode, mysql mcp server constructs SseServerTransport without passing security settings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the...
CVE-2023-52235-PoC-SPACEX-STARLINK-DNS-Rebinding
https://hackintoanetwork.com/blog/2023-starlink-dns-rebinding-attack-eng...
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
Impact The expression compiler's sanitizer resolved through a dynamically-scoped this, so a class field named sanitize rebound it and reached the Function constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a member's expression could run a...
NPM: n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
NPM: n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...
EUVD-2026-75180
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader...
CVE-2026-87996
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...
CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...
CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...
CVE-2026-87996
Open WebUI (self-hosted AI platform), versions 0.9.6 through 0.11.1 , is affected by an SSRF via DNS rebinding in the SafePlaywrightURLLoader component (backend/open_webui/retrieval/web/utils.py). The root cause is a trust mismatch: a user-controlled hostname is validated in Python, but the Playw...
