CVE-2026-39363

CVE-2026-39363 — Vite Dev Server 任意文件读取 PoC 针对 GHSA-p9ff-h696-f583 的可直接运行 PoC。通过未鉴权的 HMR WebSocket 调用 fetchModule，绕过 HTTP 层的 server.fs.allow 限制，读取 dev server 所在机器上的任意文件。 影响范围 版本线| 受影响| 已修复 ---|---|--- Vite 6| =6.0.0, =7.0.0, =8.0.0, → 403）。 2. 但 HMR WebSocket 的握手只校验： Sec-WebSocket-Protocol:...

CVE-2026-52680_exploit

CVE-2026-52680 — Apache Kyuubi REST 批处理路径遍历任意文件写入 在 Apache Kyuubi 的 REST API 中，通过 multipart 批量提交端点 可实现未经认证的任意文件写入。 POST /api/v1/batches（multipart/form-data）会将 resourceFile 部分写入 $KYUUBIHOME/work/upload//，使用的是客户端提供的文件名 ，且没有 路径遍历检查（kyuubi-common 的 Utils.writeToTempFile）： val filePath =...

CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – GraphQL 持久化查询注入（通过 ID 操纵） 程序代码（Node.js） // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ; app.post'/graphql', graphqlHTTP schema: schema, customExecuteFn...

CVE-2026-21020-Protobuf-Message-Parsing-Polymorphic-Deserialization-Vulnerability

CVE-2026-21020 – Protobuf 消息解析多态反序列化漏洞 程序代码（Python，使用 protobuf） protovuln.py - Insecure handling of Any type import addressbookpb2 Example protobuf Simulated deserialization that trusts an injected typeurl from google.protobuf import anypb2 anymsg = anypb2.Any anymsg.typeurl =...

flowise-arbitrary-file-read-getFileFromStorage

Flowise 未认证任意文件读取（getFileFromStorage）— 拟议的新 CVE 这是独立于 CVE-2025-71338（即 写入 型漏洞）的另一个漏洞。这是 Flowise 文档存储加载器 “rehydrate” 路径中的一处未认证任意文件读取 漏洞，影响 1.7.1 – 2.2.3 ，在 2.2.4 中修复。 读取 /root/.flowise/encryption.key 即可获得解密所有已存储提供商凭据的密钥 → 导致凭据全面泄露。 目录 文件| 用途 ---|--- report.md| 新 CVE...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX 插件 + WPL Real Estate │ │ ├─ privatekey = │ │ ├─ cmd = setproperty │ │ └─ file = imageNxabc.php │ │─────────────────────────────────────────►│ │ │ API validates keys ✓ │ │ Saves file no type check │...

IoRingReadWritePrimitive

IoRingReadWritePrimitive 将任意内核写入/递增转换为 Windows 11 22H2+ 上完整读写原语的后渗透利用技术 此 PoC 使用 HackSysExtremeVulnerableDriver 驱动。PoC 同时支持任意写入和任意递增，通过从 main 传入函数的标志进行控制。如需任意递增，请从源码编译最新的 HEVD 驱动。 技术文章: https://windows-internals.com/one-i-o-ring-to-rule-them-all-a-full-read-write-exploit-primitive-on-windows-11/ ...

security-research

安全研究 与我的个人安全研究相关的文件集合。更多内容将发布在我的博客 https://blog.mirch.io 上。 工具 工具| 描述 ---|--- openssldircheck| 用于检查 OpenSSL 库中 OPENSSLDIR 构建参数可能使用的不安全路径的 Windows 实用程序 ssscache2john| 将 SSSD LDAP 缓存文件转换为 John The Ripper 格式 DumpTompcatSessions| 使用 JMX 转储 Tomcat 会话 漏洞 CVE-2025-32463 - Sudo...

marshalsec

Java 反序列化安全 - 将你的数据变成代码执行 如果你是冲着 Log4Shell/CVE-2021-44228 来的，你可能想阅读关于 利用向量以及受影响的 Java 运行时版本的内容： https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ 论文 距离 Chris Frohoff 和 Garbriel Lawrence 发表他们关于 Java 对象反序列化漏洞的研究已经过去两年多，这些研究最终导致了可以说是 Java 历史上最大规模的一波远程代码执行漏洞。 对此问题的研究表明，这些漏洞并非仅存在于像 Java...

CVE-2026-106177

A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability...

kernel: nfsd: initialize copy-notify stateid before publishing it

A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

qu1ckr00t

qu1ckr00t 一个演示 Android 内核任意读/写（CVE-2019-2215）能力的 PoC 应用程序。Writeup：https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00t 是一个概念验证（PROOF OF CONCEPT）。请勿在存有重要用户数据的个人设备上使用。它仅在 Pixel 2 上测试过。在其他设备/内核上运行很可能会导致崩溃甚至数据丢失。如果提示安装额外的 Magisk 环境文件或升级 Magisk，请勿操作，因为这将修补 boot，破坏下次启动时的...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

kernel: nfsd: initialize copy-notify stateid before publishing it

A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...

Security Bulletin: Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

Summary Multiple vulnerabilities have been addressed in the Sniffer component as part of IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-75875 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary code due to path traversal. CWE:CWE-22:...

Important: Red Hat Security Advisory: postgresql:12 security update

An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

Important: Red Hat Security Advisory: postgresql:12 security update

An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...