CVE-2026-91723

Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91725

Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91722

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91727

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-91721

Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-91717

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

CVE-2026-91712

Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91713

Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91715

Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91719

Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-91714

Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91718

Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91716

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91711

Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91710

Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91708

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91709

Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2024-49019-rayng

利用 CVE-2024-49019：证书服务器权限提升 概述 CVE-2024-49019 是 Active Directory 证书服务 AD CS 中的一个漏洞，允许攻击者通过滥用基于证书的身份验证来提升权限。本指南演示如何使用 Certipy 利用此漏洞。 凭据表 虚拟机| 用户名| 密码 ---|---|--- Windows Server 2022| Administrator| !@windowsadmintest101 Windows Server 2022| testuser| $Vulnerable139 Kali-VM| vagrant| vagrant...

CVE-2022-23648-POC

CVE-2022-23648 的 PoC 这是 @fel1x 发现的 CVE-2022-23648 的概念验证。披露信息见此处，CVE 信息见此处，还有一篇博客提供了更多信息和缓解建议，见此处。Containerfile 中包含了所需信息，你可以更改 VOLUME 的目标路径来尝试不同的路径。 展示其效果的最简单方式是使用 KinD，它带有可利用的镜像。 基本测试步骤 除非节点碰巧在 /var/lib/kubelet/pki 中存有大量数据，否则这应该是一个安全的测试。 kind create cluster --image=kindest/node:v1.21.1 kubectl...

shiro

CVE-2026-49268 — LDAP 注入认证绕过漏洞的分析与修复 | ---|--- 分支| 1.13-CVE-2026-49268 作者| Jinwoo Hwang https://JinwooHwang.com 此分支（1.13-CVE-2026-49268）包含对 Apache Shiro 1.13 版本中 LDAP 注入认证绕过漏洞的全面安全修复。 官方 NVD 描述 远程攻击者可以将 LDAP 特殊字符注入到 DefaultLdapRealm 类中的 可分辨名称（DN）构造过程中。用户提供的用户名输入被直接拼接到 LDAP DN 模板中，未对 RFC 2253...