FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

CVE-2026-105396

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT 인증 우회 데모 프로젝트 목표 이 프로젝트는 통제된 로컬 랩 환경에서 CVE-2022-39227 취약점을 시연합니다. 이 취약점은 python-jwt 라이브러리3.3.4 미만 버전에 영향을 미치며, 공격자가 python-jwt와 해당 의존성인 jwcrypto 간의 파싱 불일치JWS 직렬화를 악용하여 비밀 키 없이 JWT 클레임을 위조할 수 있게 합니다. 기술 스택 Python 3.9 Flask 웹 프레임워크 python-jwt 3.3.3 취약한 버전 python-jwt 3.3.4 수정/패치된 ...

Astra Linux – Vulnerability in Firefox

The “Copy Image Link” context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows—in conjunction with a Content Security Policy that stopped a redirection chain in the middle—the final image URL could contain an authentication toke...

Astra Linux – Vulnerability in libxmltok

In libexpat before version 2.2.8, crafted XML inputs could trick the parser into switching from DTD parsing to document parsing too early. A consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber would then lead to a heap-based buffer overflow...

CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2026-105396

The Heym library (versions before v0.0.112 ) is vulnerable to a token leakage flaw within the build_public_base_url() function. An unauthenticated attacker can spoof Origin or X-Forwarded-Host headers to redirect HITL (Human-in-the-Loop) review links to an attacker-controlled domain. By triggerin...

CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

EUVD-2026-92414

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

cve-2026-21858

CVE-2026-21858 + CVE-2025-68613 - Полная цепочка n8n Неаутентифицированное произвольное чтение файлов → Подделка токена администратора → Обход песочницы → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Критический Затронутые| = 0.211.0 RCE Исправлено| 1.121.0 AFR /...

CVE-2018-0114

CVE-2018-0114 до версии 0.11.0 Неаутентифицированный удаленный злоумышленник может подписать повторно, используя ключ, встроенный в токен. https://www.cvedetails.com/cve/CVE-2018-0114/...

CVE-2025-26399

CVE-2025-26399 이 탐지 방법은 어떻게 작동하나요? 이 스크립트는 SolarWinds Web Help Desk 인스턴스에서 CVE-2025-26399에 취약한지 탐지합니다. Helpdesk 로그인 페이지를 요청하고, 응답에서 제품 식별자를 확인하며, 포함된 빌드 토큰을 버전 문자열로 추출한 다음 12.8.7.0보다 낮은 버전을 실행 중인 시스템을 플래그로 표시합니다. 이 스크립트를 어떻게 실행하나요? 1. 여기에서 Nuclei를 다운로드하세요. 2. 템플릿을 로컬 시스템에 복사하세요. 3. 다음 명령을 실행하세요:...

CVE-2026-69836-EXP

CVE-2026-69836 Entra ID 인증되지 않은 RCE 개념 증명 개요 CVE-2026-69836은 신뢰할 수 없는 데이터의 안전하지 않은 역직렬화CWE-502로 인해 발생하는 Microsoft Entra ID의 심각한 인증되지 않은 원격 코드 실행 취약점입니다. 이 결함으로 인해 공격자는 인증, 사용자 상호 작용 또는 특별한 권한 없이 네트워크를 통해 임의 코드를 실행할 수 있습니다. 이 PoC는 패치 적용 환경에서 전체 RCE를 달성하는 익스플로잇을 입증하여, Microsoft 365, Azure 및 연결된 Saa...

CVE-2026-103511

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

CVE-2026-103510

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server...

CVE-2026-100103

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7

CVE-2025-25748 - HotelDruid 3.0.7의 교차 사이트 요청 위조CSRF 취약점 설명 HotelDruid 3.0.7의 gestioneutenti.php 엔드포인트에 있는 교차 사이트 요청 위조CSRF 취약점으로 인해 공격자는 출처 또는 리퍼러 검증 부재와 CSRF 토큰의 부재를 악용하여 인증된 사용자를 대신해 승인되지 않은 작업예: 사용자 비밀번호 수정을 수행할 수 있습니다. 영향 승인되지 않은 비밀번호 변경: 공격자가 사용자 비밀번호를 덮어쓰기하여 계정 완전 탈취로 이어질 수 있습니다. 세션 라이딩: 공격...

CVE-2026-103510 Authentication bypass via blank auth token in P4Search

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server...

CVE-2026-103510 Authentication bypass via blank auth token in P4Search

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server...