CVE-2025-27591

CVE-2025-27591 introduction below versions v0.9.0 are vulnerable to a local privilege escalation vulnerability duo to the fact that the program creates a world-writable log file, an a world writable log file instead, the attacker can replace the log file with a symblink to any system-critical fil...

codeql-workshop

使用 CodeQL 发现漏洞 原始工作坊由 Sylwia Budzynska 编写 先决条件 • 资源 • 工作坊 适用对象 ：安全工程师、安全研究人员、开发人员。 你将学到什么 ：学习如何使用 CodeQL 进行代码探索和发现安全问题。 你将构建什么 ：基于安全公告构建一个 CodeQL 查询，以发现命令注入漏洞。 📣 先决条件 你可选择以下两种方式之一来运行工作坊练习： 选项 A：本地安装（使用 VS Code——CodeQL 在你的机器上本地运行） 选项 B：GitHub Codespace（使用浏览器或 VS Code——CodeQL 在云中基于 Linux 的 GitHub...

blueshrimp

针对 CVE-2025-48593 的概念验证，基于对补丁的分析。 你无需为此担心。据我所知，手机不会 受到 CVE-2025-48593 的影响。该问题仅影响支持充当蓝牙耳机/扬声器的 Android 设备，例如某些智能手表、智能眼镜和汽车。此外，攻击者必须先让受害者与其配对，之后才能访问耳机服务。只要你不接受智能手表/眼镜/汽车上的配对请求，就不会有事。 这个概念验证没有任何实际用途：它只会让 Android Automotive 模拟器崩溃，报错 fault addr 0x4141414141414141。 你可以在我博客上阅读我的分析文章。 结果 在 Android Studio...

exim-rce-cve-2018-6789

Exim RCE CVE-2018-6789 学习环境 描述 这是一套文件、脚本、笔记等，用于搭建环境以研究 Exim RCE CVE-2018-6789。可用于调试 Exim、编写漏洞利用代码、追踪 Exim 函数调用、了解 Exim 自定义内存管理（storeblocks）、理解真实世界漏洞利用的工作原理等。 仅应用于学术目的！ 要求 Vagrant 配合 libvirt/KVM（vagrant-libvirt 插件） Docker（仅当你决定在宿主机上运行 Docker 而非在 Vagrant 虚拟机内时） 设置 通过执行以下命令下载 Exim 的源代码： root@kitploi...

CVE-2026-57239

Foxit PDF Reader LPE 针对 CVE-2026-3775/CVE-2026-3780 和 CVE-2026-57239 的概念验证漏洞利用程序，可通过 Foxit PDF Reader 更新服务获取 NT AUTHORITY\SYSTEM 权限。 构建 直接编译二进制文件，将其放到目标系统上并运行即可。 root@kitploit: cargo build --release 用法 该程序有三个主要入口点：check、exploit 和 cleanup。参数的作用应该很清楚。默认情况下，exploit 之后会自动调用...

januscape

Januscape — Linux KVM/x86 客户机到宿主机逃逸跟踪站点 Januscape 补丁状态跟踪器的源码：一个单页站点，记录哪些发行版已为 Linux 内核中的 KVM/x86 客户机到宿主机逃逸发布了修复。 事实存放位置 关于该漏洞的所有信息——CVE ID、受影响版本与已修复版本、上游修复提交、发现与披露致谢，以及各发行版当前的补丁状态——均属于跟踪页面，而非本 README： 渲染页面： https://kimmo.cloud/januscape/ 源文件： site/content/index.md 编辑该文件即可；本仓库中的其他一切皆为构建基础设施。...

ipv6_frag_escape

IPV6FRAGESCAPE — Linux IPv6 分片容器逃逸追踪站点 IPV6FRAGESCAPE 补丁状态追踪器的源码：一个单页站点，记录哪些发行版已为 Linux 内核中的 IPv6 分片容器逃逸漏洞发布了修复。 事实信息所在位置 关于该漏洞的所有信息——CVE ID、受影响版本与已修复版本、上游修复提交、发现与披露致谢，以及各发行版的最终补丁状态——均属于追踪器页面，而非本 README： 渲染页面： https://kimmo.cloud/ipv6fragescape/ 源码： site/content/index.md 编辑该文件；此仓库中的其他所有内容均属构建基础设施...

K000163138: Linux kernel vulnerability CVE-2026-53258

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: wifi: fix leak if split 6 GHz scanning fails rdev-intscanreq is leaked if cfg80211scan fails. Note that it's supposed to be released at cfg80211scandone but this doesn't happen as rdev-scanreq is NUL...

krane v0.1.6

Krane Kubernetes RBAC Analysis made Easy Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its...

database-sentinel

🛡️ Database Sentinel Una skill de Claude que audita tus backends de base de datos para vulnerabilidades de seguridad. Colócalo en Claude Code, Cursor o cualquier entorno potenciado por Claude. Di "audita mi base de datos" y obtén un informe de seguridad completo con el código de corrección exacto,...

DIRTYFAIL

DIRTYFAIL 针对 Copy Fail 和 Dirty Frag Linux 页缓存写入漏洞家族的 统一检测器与 PoC 框架。 ██████╗ ██╗██████╗ ████████╗██╗ ██╗███████╗ █████╗ ██╗██╗ ██╔══██╗██║██╔══██╗╚══██╔══╝╚██╗ ██╔╝██╔════╝██╔══██╗██║██║ ██║ ██║██║██████╔╝ ██║ ╚████╔╝ █████╗ ███████║██║██║ ██║ ██║██║██╔══██╗ ██║ ╚██╔╝ ██╔══╝ ██╔══██║██║██║...

PT-2026-83777

Name of the Vulnerable Software and Affected Versions diem-project diem versions prior to 5.1.4 Description An OS command injection flaw exists in the Administrative Console component. A remote attacker can exploit this by manipulating the dm command argument passed to the executeCommand function...

PT-2026-83795

Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...

Linux Distros Unpatched Vulnerability : CVE-2026-80673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute- list entry in ntfsexternalattrfind When resolving an...

Linux Distros Unpatched Vulnerability : CVE-2026-80665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns...

Linux Distros Unpatched Vulnerability : CVE-2026-82677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer...

Linux Distros Unpatched Vulnerability : CVE-2026-33245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components RSC APIs, there is a potential...

CVE-2026-19873

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

PT-2026-84054

Name of the Vulnerable Software and Affected Versions QVidium Opera11 version 3.3.2a26-Ax4x-opera11 Description An unauthenticated command injection issue exists in the CGI Script component. A remote attacker can exploit this by manipulating the ipaddr argument within the '/cgi-bin/net tr.cgi'...

ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems

Recently, large language model LLM agents, such as Codex, Claude Code, and OpenClaw, have become capable of planning and executing long-horizon tasks through repeated tool calls. This capability also creates new opportunities for prompt injection. Existing attacks either place the malicious...