Linux Distros Unpatched Vulnerability : CVE-2026-18040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF2^8 arithmetic used lookup tables indexed by field...

azbelt

azbelt 用于枚举 Azure 相关凭据的独立 DLL 和 sliver 扩展，主要针对已加入 AAD 的机器 模块 aadjoin - 通过 NetGetAadJoinInformation 获取机器的 AAD 状态信息 credman - 从凭据管理器获取凭据 env - 查找可能包含机密的 Azure/AAD 特定环境变量 managed - 调用 IMDS 端点获取具有托管身份的机器的信息 msal - 在各个 MSAL 缓存中查找令牌。解析令牌以显示作用域和有效性 sso - 如果机器已加入 AAD，获取已签名的 PRT cookie tbres - 从...

cve-2026-31431

CVE-2026-31431 — Linux 内核 algifaead “复制失败”：分析 针对 CVE-2026-31431 （CVSS 3.1 7.8 高危 ， AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H）的安全研究：AFALG AEAD 接口链中的三个可组合设计 缺陷串联成一次确定性、无竞态的 4 字节页缓存写入，可写入任意可读文件的任意偏移 ——磁盘副本保持干净，因此磁盘上的校验和看不到任何异常。公开漏洞利用（“复制失败”，Theori/Xint）以 732 字节的 Python 将其转化为本地提权（LPE）；该缺陷存在于 2017 年至 2026...

retbleed-speculative-execution-poc

Retbleed：通过 RSB 下溢实现任意推测性代码执行 对 Retbleed（CVE-2022-29900 / CVE-2022-29901） 的动手复现——这是 2022 年的微架构攻击，它打破了“Retpoline”防御，证明了长期以来被认为安全的 ret 指令在 CPU 的返回栈缓冲区（RSB）下溢时可以被劫持。 本项目在 gem5 中的 x86 乱序 CPU 模型上模拟完整的攻击生命周期：触发 RSB 下溢，通过 Flush+Reload 缓存侧信道逐字节泄露机密数据，然后验证一种关闭该泄露的软件缓解措施（lfence）。 课程项目——高级计算机体系结构，2025...

WP2Shell

WP2Shell - WordPress 预认证 RCE 漏洞利用工具 CVE-2026-63030 + CVE-2026-60137 版本: 4.0.0 作者: G0D150NE 📌 概述 WP2Shell 是一款针对 WordPress 预认证远程代码执行的全链路漏洞利用工具，它组合了两个严重漏洞： CVE-2026-63030 - REST API 批量端点中的 SQL 注入 CVE-2026-60137 - 通过 oEmbed 缓存投毒绕过身份验证 该工具允许在无需任何身份验证 的情况下完全攻陷存在漏洞的 WordPress 站点——从检测到完整的 RCE 与持久化。 ⚡...

CVE-2026-94544

A flaw was found in Next.js. Pending cache operations do not properly separate Draft Mode requests from standard requests when fulfilling matching cache keys. Under concurrent request conditions, an unauthenticated user can receive unpublished draft content generated during an editor's session. I...

CVE-2026-94543

A flaw was found in Next.js. In self-hosted applications using the Pages Router with static generation or Incremental Static Regeneration ISR, response cache entries are not sufficiently bound to their source route. A remote attacker can exploit this issue by sending crafted requests to replace a...

CVE-2026-94484

A flaw was found in Next.js. Applications configured with root-level catch-all pages and static routes share a response cache key that does not properly distinguish between different routes. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request t...

CVE_2026_31694

CVE-2026-31694 被动扫描器 一个针对 CVE-2026-31694 的被动式 Linux 主机评估工具，该漏洞是 Linux 内核中 FUSE readdir 缓存的越界写入。 该扫描器评估运行中的内核、FUSE 暴露面、本地软件包元数据、内核源码证据、执行环境以及操作系统家族。当主机可能受影响时，它会生成针对所检测发行版量身定制的缓解指南。 作者： Aung Myat Thu w01f 目录 概述 漏洞摘要 安全模型 功能特性 要求 安装 使用方法 命令行选项 评估工作流 判定结果 退出代码 检测来源 发行版支持 缓解措施生成 容器与 WSL 行为 报告格式 自动化与集成...

CVE-2026-94544

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94543

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94484

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

CVE-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

CVE-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

CVE-2026-94484

The Next.js React framework is vulnerable to cache poisoning in versions 15.0.0 through 15.5.27 and 16.3.8 . The root cause is an insufficiently scoped shared response cache key used by applications with a root-level catch-all page and statically generated or Incremental Static Regeneration (ISR)...

CVE-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

EUVD-2026-91670

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543

The Next.js framework (versions 15.0.0 through 15.5.27 and 16.3.8 ) is vulnerable to cache poisoning in self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration (ISR) pages. The root cause is that response cache entries are not sufficiently boun...

CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...