Shellcode-Hide

Este repositorio no tiene un README...

NewPowerDNS

NewPowerDNS NewPowerDNS es una versión actualizada del PowerDNS de @domchell. La principal característica añadida es el soporte para transferir archivos mediante registros DNS A. A continuación se muestra una lista completa de las modificaciones realizadas: Soporte para transferencia mediante...

EUVD-2026-64182

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3...

CVE-2026-61539

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...

EUVD-2026-64146

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-61539

Xinference (an inference API for open-source, speech, and multimodal models) versions 2.5.0 and earlier are vulnerable to remote code execution via unsafe use of Python's eval() in Llama3 tool-call parsing. An unauthenticated remote attacker can craft a prompt sent to /v1/chat/completions with a ...

CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-62675

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validateagentbundle does not reject a tools..callable dotted Python path...

CVE-2026-62675 Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validateagentbundle does not reject a tools..callable dotted Python path...

dsh2shell

dsh2shell Unauthenticated RCE PoC for expo...

CVE-2022-RCE

CVE-2022-XXXX Inyección de datos basura inversa Suscripción CVE Herramientas Explotación Tutorial Exploit POC RCE LOG4j Deserialización JNDI Payload CVE-2022-20550 CVE-2022-20551 CVE-2022-20552 CVE-2022-20553 CVE-2022-20554 CVE-2022-20555 CVE-2022-20556 CVE-2022-20557 CVE-2022-20558 CVE-2022-2055...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webflux - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...

ScubaGear

...

CVE-2026-59318

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

EUVD-2026-63933

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59318 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59318

Spring AI's tool calling support contains a boundary enforcement flaw: the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked,...

tls

ztls 用 Zig 编写的 QUIC TLS 1.3 实现，严格遵守 RFC 8446 TLS 1.3 和 RFC 9001 QUIC-TLS。 状态 方面| 信息 ---|--- API 稳定性| 生产就绪 Zig 版本| 0.16.0 平台| Linux、macOS、Windows 性能说明 在 Ed25519 和 RSA-2048 证书配置上已验证了小于 2 毫秒的握手目标。secp256r1 P-256 工作负载当前每次握手运行 2–3 毫秒，原因是上游 Zig stdlib 的限制（PERF-229）。完整决策记录见 ADR-0002。 特性 ✅ 符合 RFC - 实现 TL...