cve-2024-52005-poc

CVE-2024-52005: ANSI Escape Sequence Injection in Git Overview This repository contains a Proof-of-Concept PoC demonstrating CVE-2024-52005, a vulnerability in Git that allows ANSI escape sequence injection through the sideband channel during Git operations. CVE-2024-52005 is a High severity CVSS...

CVE-2026-39987_PoC

CVE-2026-39987-PoC Disclaimer This script is for educational and authorized testing purposes ONLY. Unauthorized use of this tool against systems without explicit permission is ILLEGAL. The author is not responsible for any misuse of this information. Marimo versions prior to 0.23.0 have a critica...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE via Terminal WebSocket / / | / / / | \ / \ \ / / | // / \ / / | | / / // // / / // // \ / Status: Patched in 0.23.0 — marimo-team/marimo@c24d480 Vulnerability The /terminal/ws endpoint lacks the validateauth call present in every other authenticated endpoint...

CVE-2026-111079

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...

EUVD-2026-108113

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...

CVE-2026-111079 Goose: goose: shell history and environment leak via terminal integration

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...

CVE-2026-111079

A vulnerability exists in Goose where the terminal integration feature captures shell command history and transmits it verbatim to Large Language Model (LLM) provider endpoints without sanitization. If a user inputs sensitive data such as API tokens, passwords, or environment variables , this inf...

CVE-2026-111079

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo Pre-Auth RCE Unauthenticated Remote Code Execution in Marimo via WebSocket Terminal 📌 Overview CVE-2026-39987 is a critical Pre-Authentication Remote Code Execution vulnerability affecting Marimo versions prior to 0.23.0. The /terminal/ws WebSocket endpoint completely...

CVE-2026-55579

CVE-2026-55579 — Pheditor Hardcoded Default Password RCE -critical TL;DR: Pheditor all versions ships with a hardcoded default administrator password admin embedded in its source code. There is no forced password change on first login, only a visual warning. Any unauthenticated attacker can log i...

CVE-2026-34048

CVE-2026-34048 Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and execute commands on team servers. Intro I found this issue while reviewing Coolify , an open-source self-hosted PaaS, with a very direct...

CVE-2026-39987

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

CVE-2026-48813-POC

Flawfinder-ANSI-Exploit-POC In version 2.0.19 of Flawfinder, no filename sanitization occurs when parsing possibly malicious filenames. Known affected terminals are libvte based, and the example below shows a mate-terminal. This exploit has since been fixed in version 2.0.20 as of 5/17/26 by Davi...

CVE-2026-39987

CVE-2026-39987 marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability / | |// / / / / / / |/ |/ \ / | | | \ /| | /| //|/|/ / | | | / -----/ | |/ |/ ----- \ | |/ \ / / / / //// / | |// CVE-2026-39987 Marimo /terminal/ws — Unauthenticated WebSocket...

CVE-2024-41997

Warp Terminal RCE CVE-2024-41997 Command injection via unsanitized warp:// URI scheme handler. Full writeup at 0day.gg. Summary Property| Value ---|--- CVE| CVE-2024-41997 Vulnerability| Command Injection CWE-77 Target| Warp Terminal macOS Affected| v0.2024.07.16.08.02 Impact| Arbitrary command...

security-advisories

security-advisories Public security advisories published by Me Chidubem ChukwuTerminal Venom, including CVE disclosures and vulnerability reports for open-source and third-party softwares...

CyberResponders

CyberResponders: A Terminal Game CyberResponders is a terminal-based cybersecurity training game that enables players to respond to different cyber incident scenarios. Here, they have five chances to enter the correct command before the system becomes completely compromised, resulting in a game...

EUVD-2026-106227

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite component: MWA Terminal Server. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobil...

EUVD-2026-106228

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite component: MWA Terminal Server. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Linux Distros Unpatched Vulnerability : CVE-2026-81856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to...