CVE-2023-22524

Prueba de concepto de la vulnerabilidad RCE en Atlassian Companion CVE-2023-22524 Resumen Este repositorio contiene una prueba de concepto PoC para la vulnerabilidad de ejecución remota de código recientemente descubierta en Atlassian Companion para macOS, identificada como CVE-2023-22524. Este...

Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. id: CVE-2026-60105 info: name: Monst...

CVE-2023-24329-Exploit

Introducción Las funciones de análisis de URL se centran en dividir una cadena de URL en sus componentes, o en combinar componentes de URL en una cadena de URL. urllib.parse.urlparse Simplemente urllib.parse se usa para analizar URLs, podemos omitirlo agregando espacios en blanco antes de la URL...

EXPLOIT-CVE-2026-40901

DataEase — RCE sin autenticación mediante una cadena de 4 vulnerabilidades CVE-2026-40901 y otras Bypass de autenticación → bypass de la lista negra de JDBC lectura arbitraria de archivos → inyección SQL → Deserialización de Java en Quartz → ejecución remota de código comoroot. Laboratorio local...

CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-61851 Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-61851

Chartbrew is an open-source web application that connects to databases and APIs to create charts. Prior to 5.2.2 , its runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js enforced read-only database access using a blocklist of only seven SQL keywords . An authenticated u...

fastjson-1.2.60-rce

Vulnerabilidad de deserialización en Fastjson = 1.2.60 Bypass de la lista de bloqueo de autoType con 2 gadgets JNDIConfiguration, OracleManagedConnectionFactory Gadgets root@kitploit: 经过测试，命中的4个文件都是可以利用的。 不过其中HikariConfig类就是前文提到的类，在最新版本被加入黑名单，JNDIConnectionPool类在42版本前就被加入黑名单了。...

chyrp-lite-rce-poc

chyrp-lite-rce-poc CVE-2026-53767 + CVE-2026-53768 - RCE autenticado en Chyrp Lite ≤ 2026.01 "Iriomote" Ataque encadenado: bypass de la lista negra de uploadspath CVE-2026-53768 + falta de validación de la extensión de archivo en adminupdateupload CVE-2026-53767 → Ejecución remota de código como...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 Tarea imageupload → Sin autenticación → Bypass del filtro de 3 cadenas Resumen Carga arbitraria de archivos sin autenticación en DJ-Classifieds para Joomla. El endpoint de la tarea imageupload procesa las cargas de archivos sin autenticación y se basa en u...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-57141

PraisonAI (praisonai npm, a TypeScript multi-agent AI framework) is vulnerable to remote code execution via its codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts. The tool executes LLM-generated JavaScript using new Function() with a with(sandbox) pattern guarded by a regex blockl...

CVE-2026-37008

CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

PYSEC-2026-3836 GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

VulnCheck KEV: CVE-2026-60105

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...

CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

EUVD-2026-71715

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...