PT-2026-104630

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

DVIA-v2

DVIA-v2 제공: 8ksec.io Swift로 작성된 DVIA-v2 및 추가 취약점 Damn Vulnerable iOS App DVIA는 몹시 취약한 iOS 애플리케이션입니다. 이 앱의 주요 목표는 모바일 보안 애호가/전문가 또는 학생들이 합법적인 환경에서 iOS 침투 테스트 기술을 테스트할 수 있는 플랫폼을 제공하는 것입니다. 이 프로젝트는 @prateekg147이가 개발 및 유지 관리합니다. 이 앱에서 다루는 취약점과 솔루션은 iOS 11까지 테스트되었습니다. 현재 버전은 Swift로 작성되었으며 다음과 같은 취약점이...

CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning

CVE-2026-21005 – Отравление образов Docker Registry V2 Schema 1 Программный код Python Flask + Shell dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers': 'sha256:abc', 'sha256:def',...

qemu-t8030

QEMU README QEMU — это универсальный эмулятор и виртуализатор машин и пользовательского пространства с открытым исходным кодом. QEMU способен эмулировать полную машину программно без необходимости аппаратной поддержки виртуализации. Благодаря динамической трансляции он достигает очень хорошей...

GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel

ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...

CVE-2026-12405

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-12405 Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

EUVD-2026-90914

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-12405 Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-12405

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

cart

CaRT 압축 및 RC4 전송 CaRT 파일 형식은 악성코드 및 관련 메타데이터를 저장/전송하는 데 사용됩니다. 악성코드를 실행할 수 없도록 무력화하고 암호화하여 안티바이러스 소프트웨어가 CaRT 파일을 악성코드로 탐지하지 못하게 합니다. 장점 빠름FAST: CaRT는 파일을 압축하는 것만큼 빠릅니다. 스트리밍STREAMING: CaRT는 zlib 및 RC4를 사용하므로 파일을 스트리밍 방식으로 인코딩할 수 있습니다. 메타데이터METADATA: CaRT는 파일 자체와 동일한 파일에 파일 메타데이터를 저장할 수 있으며, 전체 파...

CVE-2020-10257

/ \ \ / /|| \ / |/ | | | \ V /| | / / / / || | / /| \ / / | / | | / / / || /| /// by darkcast CVE-2020-10257: WordPress TRX Addons 플러그인 비인증 원격 코드 실행 RCE 취약점 영향받는 플러그인: TRX Addons 취약점 유형: 비인증 원격 코드 실행 RCE CVSS 점수: 9.8 치명적 취약한 버전: 2.5.1 버전 이전 패치 제공 여부: 예 2.5.1 이상으로 업데이트 설명: CVE-2020-10257은 WordPres...

ROOT-APP-GOBINARY-CVE-2026-50163 CVE-2026-50163 in oras.land/oras-go/v2 - Patched by Root

Root has patched CVE-2026-50163 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-85731 CVE-2026-85731 in oras.land/oras-go/v2 - Patched by Root

Root has patched CVE-2026-85731 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-50151 CVE-2026-50151 in oras.land/oras-go/v2 - Patched by Root

Root has patched CVE-2026-50151 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...

Elysium-Vanguard-Sentinel-Audit

SENTINEL-ROOT-AUDIT: Набор для обнаружения гипервизора Honor Magic V2 ➲ Обзор проекта SENTINEL-ROOT-AUDIT — это профессиональный набор средств безопасности, предназначенный для аудита целостности ядра и обнаружения вмешательств на уровне гипервизора на Honor Magic V2 SM8550. Хотя основная...

flask-vuln-v2

В этом репозитории нет README...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses github.com/aws/aws-sdk-go-v2/service/s3 v1.96.2, github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5, tar 7.5.19, libsolv 0.7.24-5.el98, compat-openssl11 1:1.1.1k-5.el98.3, sigstore 2.3.1, and dif...

CVE-2026-85679

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-85679 Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...