CVE-2026-33017

CVE-2026-33017 — PoC неаутентифицированной RCE в Langflow Отказ от ответственности Данный репозиторий создан в исследовательских и образовательных целях в области безопасности. Используйте его только в изолированной лабораторной среде. Использование против несанкционированных систем является...

CVE-2026-21877

CVE-2026-21877 Лабораторная среда для CVE-2026-1357 1. Создание окружения sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo sudo chmod +x networkmonitor.py sudo docker compose up --build -d Firefox : http://localhost:5678 Для...

CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

CVE-2026-58400

GeoNetwork, an open-source geospatial metadata catalog maintained under OSGeo, is vulnerable to remote code execution via its Saxon XSLT processor used to render formatters. The processor lacks FEATURE_SECURE_PROCESSING and has ALLOW_EXTERNAL_FUNCTIONS enabled, allowing any loaded stylesheet to i...

CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

Project-CVE-2026-75604

Исследование безопасности обхода кэша Next.js на Windows Только оборонительные исследования безопасности и авторизованная проверка. Этот репозиторий касается CVE-2026-75604 — критической уязвимости, которая может позволить неаутентифицированное удалённое выполнение кода на некоторых развёртывания...

EUVD-2026-70526

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

CVE-2026-71963

Hermes Agent versions 0.18.2 through 0.21.0 are vulnerable to remote code execution via a crafted .git/config file in a malicious repository. The agent executes git status or git diff before trust prompts are presented to the user; by setting core.fsmonitor to an attacker-controlled command, an a...

CVE-2024-47176

CVE-2024-47176 CUPS用脆弱性スキャナー: CVE-2024-47176 CUPS脆弱性CVE-2024-47176のマススキャナーは、Common Unix Printing System（CUPS）を実行している複数のシステムにおいて、CVE-2024-47176の脆弱性の有無を検出するために設計された専用ツールです。この脆弱性は、CUPSにおいてリモートコード実行（RCE）を許すもので、ポート631上のInternet Printing...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

Project-CVE-2026-33017

Script Langflow CVE-2026-33017 — Explication du code codé par : Xer0TLabs x Persephrak Decentralized Syndicate Objet de ce document Ce document est une explication de haut niveau du programme Python fourni, destinée à la revue, à la réponse aux incidents et à l'analyse défensive. Il n'inclut...

Inject-PHP-to-JPG-Using-Jhead

Inject-PHP-to-JPG-Using-Jhead $ pkg install vim ou apt-get install vim $ pkg install jhead ou apt-get install jhead $ jhead -h pour l'aide $ jhead -purejpg yourfiles.jpg $ jhead -ce yourfiles.jpg Appuyez sur ESC, tapez :x pour enregistrer $ jhead yourfiles.jpg Exemple :...

CVE-2025-10041

CVE-2025-10041 Flex QR Code Generator = 1.2.5 - Téléchargement arbitraire de fichiers sans authentification 🚨 Flex QR Code Generator ≤ 1.2.5 - Téléchargement arbitraire de fichiers sans authentification 📝 Description Le plugin Flex QR Code Generator pour WordPress est vulnérable au téléchargement...

selenium-node-takeover-kit

Exploits Metasploit Ce projet a été déplacé. Pour obtenir la dernière version, faites un pull depuis https://codeberg.org/JonStratton/selenium-node-takeover-kit Ceci combine certains des exemples ci-dessous pour téléverser des fichiers vers, télécharger des fichiers depuis, et exécuter du code su...

CVE-2025-12737

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2026-6071

A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a...

EUVD-2026-70466

A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a...

CVE-2026-6071

Rockwell Automation Arena® is affected by a remote code execution vulnerability caused by an out-of-bounds write when parsing DOE files . An attacker can craft a malicious DOE file that, when opened by a legitimate user, writes past the end of an allocated object and executes code within the cont...

CVE-2026-9852

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue...

CVE-2026-85168

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...