4338 matches found
CVE-2023-41898_Lab
CVE-2023-41898 Unvalidated Deep Link Lab This is an educational, reduced-scope reproduction Lab built based on the public vulnerability report GHSL-2023-142 for Home Assistant Companion for Android and the open-source structure of the vulnerable version 2023.8.2. It does not use a real Home...
CVE-2023-4634
CVE-2023-4634 RCE Exploit for Wordpress Plugin Media-Library Plugin 3.10 CVE-2023-4634 Info Patrowl discovered An unauthenticated RCE Vulnerability on Media-Librairy-Assistant Wordpress Plugin in version 3.10. The exploit is not trivial and requires just a little setup explained bellow. Global...
CVE-2026-64824-PoC
CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Path Traversal → RCE CVSS 8.4 Critical · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...
ciso-assistant-community
Star the project 🌟 to get releases notification and help growing the community! intuitem.com · SaaS Free trial · Roadmap · Docs · Languages · Discord · Frameworks CISO Assistant offers a fresh perspective on Cybersecurity Management and GRC Governance, Risk, and Compliance practices: Designed as ...
CVE-2026-67598
CVE-2026-67598 Emlog Pro — Disabled TLS Certificate Validation in the AI Assistant Network-adjacent MITM → LLM-provider API-key theft & AI-response injection Summary · Attack Flow · Affected Code · Proof · Remediation · Timeline · References 📋 At a glance | ---|--- CVE ID| CVE-2026-67598 Product|...
Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion
A vulnerability in the Wordpress Media-Library-Assistant plugins in version 3.09 is vulnerable to a local file inclusion which leading to RCE on default Imagegick installation/configuration. id: CVE-2023-4634 info: name: Media Library Assistant 3.09 - Remote Code Execution/Local File Inclusion...
JetBrains Rider < 2026.2.1 Unverified Skill Auto-Update
The version of JetBrains Rider installed on the remote host is prior to 2026.2.1. It is, therefore, affected by a vulnerability: - In JetBrains Rider before 2026.2.1 AI Assistant could auto-update third-party skills without user confirmation. CVE-2026-100265 Note that Nessus has not tested for th...
mcp-server
Offensive360 MCP Server Run Offensive360 SAST scans from inside your AI assistant. This Model Context Protocol server gives Claude Code, Claude Desktop, Cursor, and any other MCP client two tools: Tool| What it does ---|--- o360scanpath| Zips a local directory, runs a full SAST scan 60+ languages...
Home Assistant: XSS in Statistics Graph Card
SummaryAn authenticated party can add a malicious name to any statistics-capable entity, allowing forCross-Site Scripting attacks against anyone who views a Statistics Graph card containing thatentity, when they hover over any data point on the chart.PayloadPayload triggeringAn alternative, and...
PYSEC-2026-4052 Home Assistant: XSS in Statistics Graph Card
Summary An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Scripting attacks against anyone who views a Statistics Graph card containing that entity, when they hover over any data point on the chart. Payload Payload triggering An alternative,...
PYSEC-2026-4051 Home Assistant: mDNS Server-Side Request Forgery
Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...
Home Assistant: mDNS Server-Side Request Forgery
SummaryHome Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal service...
sploits
sploits | Code| Description ---|---|--- CVE-2018-4310| code| MediaRemote: An access issue was addressed with additional sandbox restrictions CVE-2018-4991| code| Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper certificate validation...
PT-2026-105808
Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...
CVE-2026-100265
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...
EUVD-2026-90009
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...
CVE-2026-100265
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...
CVE-2026-100265
JetBrains Rider versions prior to 2026.2.1 are affected by a vulnerability where the AI Assistant could automatically update third-party skills without requiring explicit user confirmation. The provided documents do not specify the underlying root cause, the specific impact beyond unauthorized up...