43445 matches found
CVE-2026-113279
Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-113279
Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-113279
Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...
cplt
cplt Kernel-enforced sandbox for AI coding agents. cplt wraps GitHub Copilot CLI, OpenCode, Gemini CLI, Antigravity CLI, Pi, Claude Code, goose, DeepSeek Harness, or any shell, so the agent can write code but cannot steal credentials, push to main, merge PRs, or exfiltrate secrets. macOS : Apple...
MAL-2026-18109 Malicious code in rs-lookout-sandbox-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c On module load, index.js reads os.userInfo.username and issues an HTTPS GET to a hardcoded third-party collector at...
CVE-2026-23830-SandBreak
SandBreak CVE-2026-23830 Exploit Generator & Auto-Pwn Tool SandBreak is a robust, Go-based exploit generator designed to leverage the SandboxJS Escape vulnerability CVE-2026-23830. This tool exploits the unprotected AsyncFunction constructor in older versions of sandboxjs, allowing attackers to...
Letta-CVE-2025-51482-RCE
Letta-CVE-2025-51482-RCE Vulnerability Cause Analysis 1. Lack of Code Security Inspection Problem: The system does not perform any security inspection on user-provided source code. Evidence: generateexecutionscript method directly inserts user code into the execution script: code += "\n" +...
AgentStalker
AgentStalker Agent St atic + A ttack-graph + L ive-replay K ernel for treating an LLM agent as a system to be audited โ not a model to be aligned. ไธญๆ็ ยท v2 Roadmap ยท CodeWhale Audit Report Table of Contents Overview Validated in the Wild Features Current Capability Boundaries Architecture Quick...
Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation
= doi.org/10.5281/zenodo.18413764 = orcid.org/0009-0007-7728-256X README.md CVE-2026-0628: Chromium WebView Privilege Escalation Origin Spoofing โ Technical Research & Proof-of-Concept Author: Sastra Adi Wiguna Purple Elite Teaming Research Date: January 2026 CVE ID: CVE-2026-0628 CVSS v3.1: 8.8...
CVE-2022-40635
CVE-2022-40635: Groovy Sandbox Bypass in CrafterCMS Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. Vendor Disclosure: The vendor's disclosure and fix for this...
CVE-2025-6384
CVE-2025-6384: Groovy Sandbox Bypass 2 in CrafterCMS Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. Vendor Disclosure: The vendor's disclosure and fix for this...
CVE-2026-72530-TrueConf-Sandbox-Escape-
CVE-2026-72530: TrueConf Server Sandbox Escape - Mitigation & Detection PoC ๐ General Description This repository contains an educational demonstration of mitigation and detection for CVE-2026-72530 , a critical Code Injection and Sandbox Escape vulnerability in TrueConf Server. Vulnerability...
cve-2026-40369-exploit
This references https://voidsec.com/cve-2026-40369-browser-sandbox-escape/, the approach differs significantly from https://github.com/orinimron123/CVE-2026-40369-EXPLOIT, and since I didn't see any public exp from them, I documented it...
CVE-2026-4447
CVE-2026-4447 - V8 in Google Chrome prior to Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-20 Technical Summary...
jsPDF-Object-Injection
CVE-2026-25755 Sandbox Bypassed jsPDF Flaw to Object Injection Overview A critical PDF Object Injection vulnerability CVE-2026-25755 was discovered in jsPDF, a widely-used JavaScript library for generating PDF documents in client-side applications. The vulnerability exists in the addJS function,...
CVE-2026-27597
CVE-2026-27597 - version Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 10.0 Impact: Confidentiality, Integrity, Availability Published: 2026-02-25 Technical Summary Enclave is a secure...
CVE-2026-33229
CVE-2026-33229 โ XWiki RCE via Apache Velocity Sandbox Bypass A Remote Code Execution vulnerability in XWiki Platform that allows an authenticated user with scripting permissions to bypass the Apache Velocity sandbox entirely โ no Java Reflection required โ by traversing pre-instantiated objects...
CVE-2026-22686
Enclave VM Sandbox Escape CTF Challenge Challenge: "Breaking the Walls" Difficulty: Hard Category: Source Code Review / Sandbox Escape Points: 500 Scenario You've discovered a mysterious sandboxed JavaScript execution environment...
CVE-2026-21636
CVE-2026-21636 - Node.js Permission Model UDS/Network Bypass Vulnerability summary The Node.js permission model --permission is designed to sandbox a process by restricting access to the filesystem, child processes, workers, and network. CVE-2026-21636 reveals that connections made via undici/fet...
kern
kern: rootless container runtime and sandbox with no daemon. Runs agent tool calls and LLM-generated code in kernel-enforced containers. A real, kernel-enforced container in a few milliseconds, out of one static binary with no daemon. MCP support for Claude Code, Cursor, Claude Desktop and LM...