@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

spawn

SPAWN - BOF de Cobalt Strike BOF de Cobalt Strike que crea un proceso sacrificial, lo inyecta con shellcode y ejecuta el payload. Construido para evadir hooks de EDR/UserLand al crear un proceso sacrificial con Arbitrary Code Guard ACG, BlockDll y suplantación de PPID. Debido a ACG, esto no es...

CVE-2026-23744-POC

CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE MCPJam Inspector -i -p -m...

EUVD-2026-74909

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2022-22814_PoC

Escalada de Privilegios - AsusSystemDiagnosis.exe - Proc39 Ruta completa: C:\WINDOWS\System32\DriverStore\FileRepository\asussci2.infamd64d385bdc0d33d66f9\ASUSSystemDiagnosis\AsusSystemDiagnosis.exe Problema: El puerto ALPC \RPC Control\ASHWTestServer, expuesto por AsusSystemDiagnosis.exe, es...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

cobaltstrike4.5_cdf-1

cobaltstrike4.5cdf Crack cobaltstrike4.5, remove checksum8 feature, bypass BeaconEye, fix stage leakage via wrong path, add TOTP two-factor authentication, add encrypted username display, fix foreign spawn bug in 4.5, rename client configuration file, etc. cobalt strike4.5 crack cobaltstrike4.5...

mcpshield

mcpshield A drop-in fix for the unpatched MCP STDIO command-injection flaw the CVE-2026-30623 family, disclosed by OX Security in April 2026 as "by design" -- no SDK patch is coming. Import one line, and every stdio MCP server your Python app launches gets its command/args/env validated before th...

CVE-2026-23744-PoC

CVE-2026-23744-PoC Disclaimer: This proof-of-concept is provided exclusively for authorised security research, educational purposes, and controlled lab environments e.g., HTB, CTF, or internal penetration testing with explicit written consent. Unauthorised use against any system without permissio...

zygote-CVE-2024-31317

Zygote Toolkit - CVE-2024-31317 This is a toolkit that uses CVE-2024-31317 to extract private app data via ADB or spawn a shell with an app's UID. This vulnerability affects Android versions from 9 to 14 running on security patch level 2024-06-01 or lower. A support matrix of tested devices can b...

CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...

process-inject-kit

Process Inject Kit This is a port of Cobalt Strike's Process Inject Kit from C to the C++ BOF template. How it works The built in fork and run process injection techniques can be change with the PROCESSINJECTSPAWN and PROCESSINJECTEXPLICIT hooks. This repo provides the following: Source code...

CVE-2016-5636

CVE-2016-5636 PoC for CVE-2016-5636, which is a heap overflow in Python 3.6. This repository includes: crash-with-zip : crash PoC by reading untrusted zip file google-web-engine : crash PoC working on google web engine spawn-shell : a local exploit for spawning shell...

CVE-2026-79748 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

CVE-2026-79748

MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, contains a command injection vulnerability in the POST /api/servers and PUT /api/servers/:name endpoints prior to version 0.12.15. These endpoints spawn configured stdio processes via child_process.spawn but lack a...

CVE-2026-79748 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

Malicious code in supersignaturenature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15 The published dist/ bundles main/module/browser entrypoints contain code absent from the src/ tree: at library load they read an encrypted rsaToken...

MAL-2026-15560 Malicious code in supersignaturenature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15 The published dist/ bundles main/module/browser entrypoints contain code absent from the src/ tree: at library load they read an encrypted rsaToken...

CVE-2026-81097

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

EUVD-2026-67025

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...