CVE-2026-71940

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the aclgeneralsetup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causi...

CVE-2026-71912

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of...

CVE-2026-71911

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted...

sudo_patch_CVE-2025-32463

sudopatchCVE-2025-32463 Mr.CIA's manueller Patch-Leitfaden für CVE-2025-32463 lokale Privilegienausweitung von Sudo, getestet auf Kali Linux und Ubuntu WSL. CVE-2025-32463 Sudo Patch-Anleitung 🛡️ Eish, CVE-2025-32463 ist eine fiese lokale Privilegienausweitung CVSS 9.3 in Sudo 1.9.14–1.9.17,...

CVE-Newgen-Software-Advisories

Newgen Software – Provas de Conceito de CVE Este repositório contém material de Prova de Conceito PoC e documentação técnica para múltiplas vulnerabilidades CVE descobertas em produtos desenvolvidos por Newgen Software Technologies Limited. As vulnerabilidades documentadas aqui são CVEs...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

EUVD-2026-65060

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073

Label Studio (through 1.23.0 ) has a broken access control flaw in its annotation detail endpoint. The AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() without a get_queryset override, so any annotation is retrievable by primary key. Because permissions are ...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

dirty-pipe-poc

POC Exploit per aggiungere utente a Sudo per la vulnerabilità Dirty Pipe CVE-2022-0847 Questo repository si basa sulla vulnerabilità, writeup ed exploit prodotti da Max Kellermann, tutto disponibile qui. Come tutti, ho voluto approfittare di giocare con la più banale escalation dei privilegi da...

CVE-2025-27591-PoC

CVE-2025-27591 Proof Of Concept CVE-2025-27591 è una vulnerabilità di escalation dei privilegi che ha interessato il servizio Below prima della versione 0.9.0. Il problema derivava dalla creazione di una directory scrivibile da tutti gli utenti in /var/log/below. Un attaccante potrebbe sfruttare...

dockernymous

SCROLL DOWN FOR REQUIREMENTS AND INSTRUCTIONS IT JUST WON'T WORK IF YOU DON'T FOLLOW THEM Warning: Dockernymous is in a very early state of development. Only use it for educational purposes. DON'T use it if you rely on strong anonymity! News 13.10.2018 I completely changed the overall function...

CVE-2026-78122-POC

CVE-2026-78122 — प्रूफ ऑफ कॉन्सेप्ट Tecnativadocker-socket-proxy ≤ 0.5.0 — अपर्याप्त एक्सेस-नियंत्रण ग्रैन्युलैरिटी CWE-1220 CVSS 4.0: 8.3 उच्च — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N हमला वेक्टर एडजेसेंट आसन्न है AV:A: हमलावर को प्रॉक्सी तक लोकल/आसन्न नेटवर्क पहुँच की...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor Unauthentifizierte RCE über INLINE GraalVM Evaluator Conductor OSS / Orkes3.21.21 … vor 3.30.2 wertet benutzerbereitgestelltes JavaScript in INLINE und LAMBDA / DOWHILE / SWITCH Aufgaben mit einem GraalVM-Kontext aus, der mit vollem Host-Zugriff HostAccess.ALL erstellt...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Fehlerhafte Zugriffskontrolle Proof of Concept für eine fehlende Autorisierungsschwachstelle in MISPs Massenlöschungsvorgängen für Event Reports und Sharing Groups. Die deleteSelection-Handler autorisieren jedes ausgewählte Element mit einem Callback, der das...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentifizierungs-Bypass Einzel- & Multi-Ziel Haftungsausschluss: Dieses Dokument und das zugehörige Skript exploit.py werden ausschließlich für Bildungszwecke, Sicherheitsforschung und autorisierte Penetrationstests bereitgestellt. Verwenden Sie diese Software nicht...

CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...

enforcement-coverage

تغطية الإنفاذ تكتشف مسارات API التي تحمل تحكمًا في التفويض أضعف من مساراتها الشقيقة. عثرت على CVE-2026-45316 في Open WebUI من الكود المصدري وحده، دون أي معرفة مسبقة بنشرة أمنية: root@kitploit: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3 comparable write operations on note require...

CVE-2026-65400

CVE-2026-65400 Pela primeira vez em um bom tempo, temos um RCE no MacOS. Descoberto originalmente por @osxreverser, e posteriormente expandido por bynar.io. Veja https://blog.calif.io/p/no-country-for-old-passwords para mais informações. Isso é derivado principalmente do trabalho de @panchocosil...