CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

CVE-2026-26128

CVE-2026-26128 用于通过 Windows Active Directory 中的 Unicode 规范化利用 Kerberos 反射的 Python 工具。基于 Guillaume André / Synacktiv 的研究。 安装 这些工具仅兼容 Python 3.8+。从 GitHub 克隆仓库，安装依赖项，然后就可以使用了： root@kitploit: git clone https://github.com/jarnovandenbrink/CVE-2026-26128.git cd CVE-2026-26128 pip install -r...

CVE-2026-2395

CVE-2026-23950 CVE-2026-23950 的概念验证 - tar 包中的竞态条件漏洞。 描述 本仓库演示了 tar npm 包（版本 7.5.3）中的一个竞态条件漏洞，该漏洞允许在解压过程中发生文件冲突。该漏洞利用了 Unicode 规范化差异，其中 collisionss 和 collisionß 由于不区分大小写的冲突可能被视为同一文件。 漏洞详情 CVE ID ：CVE-2026-23950 受影响包 ：tar 受影响版本 ：7.5.3 漏洞类型 ：导致文件冲突的竞态条件 影响 ：并行解压期间文件内容损坏/覆盖 工作原理 该漏洞利用程序创建一个包含两个文件的 ta...

CVE-2023-46404

CVE-2023-46404 PCRS 是由多伦多大学开发的用于在线编程练习的 Web 应用。 参见 Bitbucket 仓库： https://bitbucket.org/utmandrew/pcrs/src/3.11/ 摘要 PCRS 的“问题”（Questions）页面（包含代码提交功能）和“代码编辑器”（Code editor）页面存在通过逃逸 Python 沙箱实现远程代码执行（RCE）的漏洞。 详情 在 PCRS 实例中，可通过使用生成器对象实现远程代码执行。通过使用生成器帧（giframe）和 fback，脚本可以穿越沙箱栈帧，在非沙箱环境中执行恶意代码。此外，Unicod...

CVE-2025-64458-Demo

CVE-2025-64458 — Django 重定向 DoS（Windows 平台） 描述 Django 重定向响应中的一个拒绝服务（DoS）问题，允许攻击者在构造重定向响应时，触发 URL 规范化期间过量的 CPU 消耗。在 Windows 平台上，Python 的 Unicode NFKC 规范化尤其缓慢。因此，使用攻击者控制的超大 Unicode URL 创建 HttpResponseRedirect/HttpResponsePermanentRedirect（或使用 django.shortcuts.redirect）会导致异常的处理时间，进而造成请求线程耗尽以及服务变慢/中断...

CVE-2025-52488

DNN Unicode路径规范化 NTLM 哈希泄露利用工具 CVE-2025-52488 概述 此利用工具针对 DNN（原名 DotNetNuke）版本 6.0.0 至 10.0.1 之前版本的漏洞，允许攻击者通过 Unicode 路径规范化攻击泄露 NTLM 哈希。 漏洞详情 CVE ID : CVE-2025-52488 严重性 : 高危（CVSS 8.6） 受影响版本 : 6.0.0 至 10.0.1 之前 攻击向量 : 网络 认证 : 不需要 工作原理 该利用工具滥用 Windows/.NET 的特殊机制和 Unicode 规范化，强制目标 DNN 服务器向攻击者控制的服务器发...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in August 2026. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6...

EUVD-2026-68681

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

PT-2026-83938

Name of the Vulnerable Software and Affected Versions URI for Perl versions prior to 5.36 Description Missing normalization in nameprep causes non-NFC host names to be encoded into non-standard punycode labels. While nameprep lowercases host labels, it fails to perform Unicode normalization to Fo...

SUSE CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

FreeBSD : terraform -- exclusion bypass in .terraformignore handling (4496ae0c-9d7d-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4496ae0c-9d7d-11f1-a655-3497f65b111b advisory. HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP...

Go-slug vulnerable to exclusion bypass in .terraformignore handling

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...

terraform -- exclusion bypass in .terraformignore handling

HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP Terraform or Terraform Enterprise when a run is started. In go-slug before v0.18.3, matching of .terraformignore rules does not consistently treat canonically equivalent Unicode filenames as the sam...

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

EUVD-2026-63099

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

CVE-2026-14978

go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...

CVE-2026-14978 Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

Security Bulletin: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...

PT-2026-78711

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...