CVE-2026-5173

🦊 CVE-2026-5173: GitLab WebSocket Unauthorized Method Execution PoC 🛠️ Overview CVE-2026-5173 allows a low-privileged authenticated attacker to call restricted backend methods through GitLab's WebSocket /-/cable endpoint, specifically via the GraphqlChannel. This can lead to sensitive data exposur...

CVE-2026-39987

CVE-2026-39987 - Marimo Pre-Authentication RCE CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting Marimo, a reactive Python notebook environment. The vulnerability exists in Marimo's terminal WebSocket endpoint: /terminal/ws The endpoint failed to...

CVE-2026-39987

⚠️ CVE-2026-39987 — Unauthenticated Shell in marimo 0.23.0 A reactive Python notebook tool gave attackers a full shell in one WebSocket request. 📌 Overview CVE-2026-39987 is a critical pre-auth RCE vulnerability in marimo — a popular open-source reactive notebook for Python modern Jupyter...

CVE-2026-1731

CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE PoC !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this...

CVE-2026-39987-PoC

CVE-2026-39987 PoC 요약 Marimo = 0.20.4은 /terminal/ws WebSocket 엔드포인트의 인증 전 RCE 취약점의 영향을 받습니다. 해당 엔드포인트는 애플리케이션 모드와 터미널 지원 여부를 확인하지만, WebSocket 연결을 수락하기 전에 인증을 검증하지 않습니다. 그런 다음 PTY 셸을 생성하여 인증되지 않은 공격자가 Marimo 프로세스의 권한으로 명령을 실행할 수 있게 합니다. 근본 원인 validateauth를 호출하는 다른 WebSocket 엔드포인트와 달리, 취약한 터미널 엔드포인...

CVE-2020-13935

Exploit for WebSocket Vulnerability in Apache Tomcat CVE-2020-13935 In the corresponding blog post the analysis and exploitation of the vulnerability is explained in detail. Usage Clone the repository, then build the tcdos binary. Run the program as follows to test whether a particular WebSocket...

CVE-2026-39987

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

CVE-2024-12356

BeyondTrust Remote Support 및 Privileged Remote Access에서 인자 주입과 PostgreSQL 문자열 이스케이프 우회를 통한 인증 없는 원격 코드 실행 윤리적 경고: 연구, 교육 및 승인된 테스트 목적으로만 사용하십시오. 허가 없이 시스템에 사용하지 마십시오. BeyondTrust Remote SupportRS 및 Privileged Remote AccessPRA는 조직의 내부 시스템으로의 권한 있는 원격 세션을 중개하는 어플라이언스로, 인터넷에 자주 노출되며 네트워크에서 신뢰할 수 있는...

dnspython

dnspython INTRODUCTION dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG-authenticated messages and EDNS0. dnspython provides both high- and low-level access to DNS. The high-level classes...

CVE-2026-39987_POC

PoC — CVE-2026-39987 · Marimo 인증 전 RCE CVSS 4.0: 9.3 Critical · AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H 영향: marimo validateauth 2회 호출. terminal.py - @requires 0회, validateauth 0회. -- 결함. AuthBackend 미들웨어는 HTTP와 /ws 웹소켓을 보호하지만, /terminal/ws는 쿠키도 토큰도 없이 연결을 수락하고 marimo 프로세스의 권한으로 PTY 셸을 포크합니다. 악용 요...

CVE-2026-39987

CVE-2026-39987 For Marimo 0.20.4 PoC ⚠️ This tool is intended for educational purposes and authorized security testing only. The creator is not responsible for any unauthorized or illegal use. Use at your own risk. ⚠️ Info: CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE...

CVE-2026-42228

GHSA-f77h-j2v7-g6mw — n8n 인증되지 않은 채팅 실행 하이재킹 CVE: CVE-2026-42228 심각도: 높음 영향 버전: n8n 1.123.32 수정 버전: n8n 1.123.32 / 2.17.4 / 2.18.1 취약점 요약 chat-service.ts :: startSession은 WebSocket 쿼리 문자열에서 executionId를 수락하고 해당 실행이 데이터베이스에 존재하는지만 확인합니다. 호출자가 해당 실행에 접근할 권한이 있는지는 절대 검증하지 않습니다. waiting 상태의 실행에 대한 유효...

CVE-2026-39987-Lab

CVE-2026-39987 — marimo 사전 인증 터미널 WebSocket RCE 실습 환경 marimo의 CVE-2026-39987을 재현하고 이해하기 위한 로컬 전용 Docker 실습 환경입니다. 이 프로젝트는 취약한 marimo 서비스와 패치된 marimo 서비스를 나란히 비교한 다음, 최소 피해 증명 스크립트를 사용하여 차이를 보여줍니다. 요약 CVE-2026-39987은 반응형 Python 노트북 프레임워크인 marimo 의 심각한 사전 인증 원격 코드 실행 취약점입니다. 취약한 동작은 터미널 WebSocket...

Linux Distros Unpatched Vulnerability : CVE-2026-76183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue...

UBUNTU-CVE-2026-76183

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

EUVD-2026-85225

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

EUVD-2026-85151

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

CVE-2026-76183: Authentication Bypass by Alternate Name

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

PT-2026-97205

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.63 Description An unauthenticated local attacker can connect to the MQTT broker via the localhost WebSocket endpoint. This access allows the invocation of exposed ddsc RPC functions, specifically the child...

CVE-2026-50227: Missing Authentication for Critical Function

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...