EUVD-2026-88998

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo Pre-Auth RCE Unauthenticated Remote Code Execution in Marimo via WebSocket Terminal 📌 Overview CVE-2026-39987 is a critical Pre-Authentication Remote Code Execution vulnerability affecting Marimo versions prior to 0.23.0. The /terminal/ws WebSocket endpoint completely...

CVE-2026-55579

CVE-2026-55579 — Pheditor : Mot de passe par défaut codé en dur menant à une exécution de code à distance RCE -critical TL;DR : Pheditor toutes les versions embarque un mot de passe administrateur par défaut codé en dur admin dans son code source. Il n'y a aucun changement forcé de mot de passe...

bbot-ui

BBOT TUI Viewer A self-contained terminal UI for browsing and analyzing BBOT scan results. Features 🚀 Zero Setup - Single self-installing file, no manual dependencies 🔴 Live Refresh - Auto-updates while scans are running with accurate status detection 🎯 Smart Status Detection - Accurately...

SUSE CVE-2026-100866

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

Code-Roulette

Code Roulette Terminal interface based, online multiplayer, Russian Roulette where the loser executes the winner's Python payload file. Code Roulette Overview How the Game Works Demo Video Usage As a Package With the UV Package Manager With Pip Payload Files Development Licensing The Main...

keepassxc-fzf

keepassxc-fzf Interactive terminal interface for managing KeePass databases using keepassxc-cli and fzf. Features Interactive entry search with fuzzy finder fzf Real-time entry preview password masked Copy to clipboard with auto-clear: Password 10 seconds Username, URL, Notes 30 seconds Keyfile...

ai-email-threat-research

Threat Terminal A cybersecurity research game measuring how humans detect AI-generated phishing emails. Built as a retro terminal experience. Live: research.scottaltiparmak.com The Problem AI can now generate phishing emails with perfect grammar, flawless spelling, and convincing context. The old...

sshelf

sshelf Fuzzy-search your SSH hosts and connect in two keystrokes. sshelf keeps its own host list, builds the ssh command for you, and then gets out of the way. It hands the terminal to real OpenSSH and never touches /.ssh/config. Install macOS and Linux, x8664 and arm64. The prebuilt packages nee...

CVE-2026-34048

CVE-2026-34048 Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and execute commands on team servers. Intro I found this issue while reviewing Coolify , an open-source self-hosted PaaS, with a very direct...

K000163437: Vim vulnerabilities CVE-2026-28420, CVE-2026-28421, and CVE-2026-28422

Security Advisory Description CVE-2026-28420 Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes...

mssql-command-tool

Инструмент подключения к терминалу mssql | выполнение команд Пример ./mssql-command-tool-mac -s 10.10.10.10 -u sa -p jas502n -P 1433 -c "whoami" nt service\mssqlserver ./mssql-command-tool-mac -s 10.10.10.10 -u sa -p jas502n -P 1433 -c "net user" \ 的用户帐户...

opencode

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation YOLO curl -fsSL...

opencode

L'agent de codage IA open source. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation YOLO curl -fsSL...

CVE-2026-39987.py

CVE-2026-39987.py Этот Python-скрипт эксплуатирует уязвимую конечную точку marimo /terminal/ws и возвращает интерактивную оболочку. КАК ИСПОЛЬЗОВАТЬ : Единственное изменение, которое необходимо внести, — это изменить переменную HOST в скрипте. После изменения переменной HOST выполните скрипт в...

poc-cve-2024-38396

CVE-2024-38396 и CVE-2024-38395 Этот PoC можно использовать либо через docker run, либо просто с помощью cat. Этот репозиторий содержит Docker-файл для vin01/escape-seq-test:cve-2024-38396. PoC просто открывает калькулятор в OS X. Как запустить: Пример 1. cat...

CVE-2026-39987

CVE-2026-39987 익스플로잇 POC 개요 이 저장소는 Marimo의 사전 인증 원격 코드 실행RCE 취약점인 CVE-2026-39987에 대한 개념 증명POC 스크립트를 포함합니다. 이 익스플로잇은 WebSocket 엔드포인트를 활용하여 대상 시스템에서 임의의 명령을 실행합니다. 취약점 세부 정보 CVE ID : CVE-2026-39987 영향을 받는 구성 요소 : 터미널 WebSocket 엔드포인트/terminal/ws 영향 : 인증 없이 수행되는 무단 원격 코드 실행 영향을 받는 버전 : -c "" python...

CVE-2026-48813-POC

Flawfinder-ANSI-Exploit-POC Dans la version 2.0.19 de Flawfinder, aucune désinfection des noms de fichiers n'est effectuée lors de l'analyse de noms de fichiers potentiellement malveillants. Les terminaux affectés connus sont basés sur libvte, et l'exemple ci-dessous montre un mate-terminal. Cett...

CVE-2026-100866

A flaw was found in onefetch. An attacker can manipulate terminal output by embedding control characters and escape sequences into project manifest fields, such as the project name or version. When a user runs onefetch in an untrusted repository, these unsanitized values are printed directly to t...