CVE-2026-42208_lab

LiteLLM Proxy SQL 注入（GHSA-r75f-5x8p-qvmc） 一个用于复现 LiteLLM Proxy API 密钥认证流程中 SQL 注入漏洞的环境。 漏洞摘要 项目| 详情 ---|--- 安全公告| GHSA-r75f-5x8p-qvmc 类型| SQL 注入（CWE-89） 严重程度| 严重 受影响版本| litellm =1.81.16, =1.83.7（提交 4dc416ee74） 攻击路径 注入发生在错误处理回调路径 中，而非主认证流程。当发送非 sk- 前缀的令牌时，断言失败，原始（未哈希）令牌会流经失败回调链，进入使用 f-string 插值的 S...

jq-els-backport-cve-2025-48060

jq-els-backport-cve-2025-48060 已将 CVE-2025-48060（jvstringempty 中的堆缓冲区溢出）的上游修复反向移植到 jq 1.6。 反向移植（CVE-2025-48060）—— 将上游提交 c6e0416（“修复格式化空字符串时的堆缓冲区溢出”）从较新的 jq 版本反向移植到 jq-1.6，调整了内部字符串表示（jvstringempty），添加了回归测试（0implode），并成功重新构建和运行了测试套件。 如何应用此补丁 你可以在官方 jq-1.6 版本之上应用此反向移植，既可以基于 tarball，也可以基于 git checkou...

Rainfall

降雨 降雨 是一个比 Snow Crash 稍复杂的 iso 挑战。你需要深入研究逆向工程，学习重构代码，并理解它以便发现漏洞。你能达到最后一关吗？ 描述 降雨 是 42 网络安全分支的一个项目，继 Snow Crash 之后，但其目标是利用 ELF 格式的文件作为 C 可执行文件。 必须使用不同的技术来获取每个级别的密码： 缓冲区溢出 格式化字符串漏洞 shellcode 创建 GOT 覆盖 需要熟悉汇编语言（x86 和 x86-64）和 GDB，才能理解反汇编后的 C 可执行文件。 评估 我们于 2025 年 3 月通过了该项目，分数为 125/100。 已验证的加分项 完成...

glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

MAL-2026-16069 Malicious code in reactlogo-load (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...

CVE-2025-55182-VulnCheckPOC

PoC de Verificación de Vulnerabilidad CVE-2025-55182 Escáner de prueba de concepto para detectar la vulnerabilidad de React Server Components RSC en aplicaciones Next.js CVE-2025-55182. Uso Esto es solo una comprobación para ver si un servidor es vulnerable, basada en esta publicación de...

CVE-2026-73309

CVE-2026-73309 XenForo 2.3.13 之前的版本在空字符串到达令牌端点时，可能会跳过 OAuth2 客户端密钥和 PKCE 验证。 发生了什么 该端点会检查 clientsecret 和 codeverifier 键是否存在，然后仅在其 PHP 字符串值为真值时才执行比较。因此，空值可以满足存在性检查，但会绕过比较。 对于公共 OAuth 客户端，攻击者仍然需要有效的授权码。该漏洞移除了 PKCE 中“仅有授权码是不够的”这一保证：授权码可以在没有验证器的情况下进行交换，从而生成具有用户批准范围的令牌。相同的假值模式也影响了机密客户端的检查。...

CVE-2026-71808

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

EUVD-2026-75159

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

CVE-2026-71808

CVE-2026-71808 is a SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 . The root cause is the use of ${} string concatenation in MyBatis Mapper files—specifically AdminMapper.java , MerchantWithdrawRecordMapper.java , and MemberWithdrawRecordMapper.java —which allows remote authent...

EUVD-2026-70736

Colord: Slow rejection of oversized malformed color strings...

GHSA-2WM5-Q62R-HMRV Colord: Slow rejection of oversized malformed color strings

Impact colord's CSS color string matchers described a number as +-?\d.?\d+. In that form \d and \d+ can match the same digits, so a run of n digits can be divided between them in On² ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long...

CVE-2026-19651

CVE-2026-19651 affects the quarkus-spring-web extension in IBM Enterprise Build of Quarkus versions 3.27.1–3.27.5 and 3.33.1–3.33.3 . The root cause is that the system incorrectly reads the URL query string as a request header, resulting in incorrect mapping of values to untrusted query string in...

CVE-2026-69395

Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...

EUVD-2026-73692

Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...

CVE-2026-69395

Active Directory Certificate Services (AD CS) contains a vulnerability caused by the use of an externally-controlled format string , allowing an authorized attacker (low privileges required) to disclose information over a network . The CVSS v3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR...

glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string

A flaw was found in the GNU C Library glibc. This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the fopen function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive...

Aurelia-Path < 1.1.7 - Prototype Pollution

Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs. id: CVE-2021-41097 info: name: Aurelia-Path 1.1.7 - Prototype Pollution author: 0xAkoko...

EEF-CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Summary Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...