kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition t...

kernel: ALSA: timer: Fix UAF at snd_timer_user_params()

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA timer component. A race condition can occur during the release of a timer object, specifically when the SNDRVTIMERIOCTLPARAMS ioctl is called concurrently. This can lead to a use-after-free vulnerability, potentially...

kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. A remote attacker, by sending a specially crafted short authentication frame during the SAE Simultaneous Authentication of Equals authentication exchange, could trigger a heap overflow. This vulnerability allows for potential arbitrary...

Project-CVE-2026-33017

CVE-2026-33017 Langflow 스크립트 — 코드 설명 coded by: Xer0TLabs x Persephrak Decentralized Syndicate 이 문서의 목적 이 문서는 검토, 사고 대응 및 방어적 분석을 위해 제공된 Python 프로그램에 대한 높은 수준의 설명입니다. 이 문서는 의도적으로 운영 지침, 대상 선택 가이드, 페이로드 예시 또는 시스템 접근 권한 획득 절차를 포함하지 않습니다. 이 스크립트는 주장된 Langflow 인증 없는 원격 코드 실행 취약점에 대한 익스플로잇으로 자체 표시됩니다. ...

Inject-PHP-to-JPG-Using-Jhead

Jhead를 사용하여 JPG에 PHP 주입하기 $ pkg install vim or apt-get install vim $ pkg install jhead or apt-get install jhead $ jhead -h 도움말 보기 $ jhead -purejpg yourfiles.jpg $ jhead -ce yourfiles.jpg ESC를 누른 후 :x를 입력하여 저장하세요 $ jhead yourfiles.jpg 예시 : site.com/youfiles.php?cmd=Command Here...

CVE-2026-28496

CVE-2026-27604 + CVE-2026-28496 — FOSSBilling 사전 인증 RCE 체인 요약 이 저장소는 두 개의 연쇄 취약점으로 구성된 FOSSBilling 사전 인증 RCE 체인을 재현하고 검증하기 위한 로컬 Docker 랩을 포함합니다:...

CVE-2025-10041

CVE-2025-10041 Flex QR Code Generator = 1.2.5 - 인증되지 않은 임의 파일 업로드 🚨 Flex QR Code Generator ≤ 1.2.5 - 인증되지 않은 임의 파일 업로드 📝 설명 WordPress용 Flex QR Code Generator 플러그인은 saveqrcodetodb 함수에서 파일 유형 검증이 누락되어 1.2.5를 포함한 모든 버전에서 임의 파일 업로드에 취약합니다. 이로 인해 인증되지 않은 공격자 가 영향을 받는 사이트의 서버에 악성 파일을 업로드할 수 있으며, 잠재적으로 ...

selenium-node-takeover-kit

Metasploit エクスプロイト このプロジェクトは移転しました。最新版を入手するには、https://codeberg.org/JonStratton/selenium-node-takeover-kit から pull してください。 これは、以下の例の一部を組み合わせて、Selenium ノードへのファイルのアップロード、Selenium ノードからのファイルのダウンロード、およびコードの実行（“COMMANDTYPE” パラメータ経由）を行います。RCE は現在 Linux でのみ動作します。インストールするには、これを...

CVE-2026-92970

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...

CVE-2026-92955

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

CVE-2026-92950

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses requirefilename to re-execute itself in the host realm, bypassing sandbox...

CVE-2026-92948

vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7...

CVE-2026-92938

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92939

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

CVE-2026-92934

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

cve-2025-53770-research

cve-2025-53770-research 🚨 SharePoint "ToolShell" RCE 제로데이CVE-2025-53770에 대한 위협 인텔리전스 및 침해 대응 연구. 🕵️‍♂️ 근본 원인 역직렬화 결함, 공격 타임라인, 위험 지표, 방어 EDR 검증 플레이북을 다룹니다. 🛡️ 🕵️ CVE-2025-53770 — SharePoint "ToolShell" 제로데이 연구 Microsoft SharePoint "ToolShell" RCE 제로데이에 대한 위협 인텔리전스 및 침해 대응 연구. 근본 원인 역직렬화 결함, 공격...

CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – xsl:script를 통한 XSLT 서버 측 주입 프로그램 코드 Python + XSLT root@kitploit: xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml = request.form'xml' xslt =...

CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016 – 악성 PyPI 패키지 설치 후크 setup.py 실행 프로그램 코드 Python root@kitploit: setup.py - Malicious package that executes during install from setuptools import setup import os This runs on pip install os.system'id /tmp/pwnedbypackage' setup name='harmless-pkg', version='1.0', packages=,...

CVE-2026-92955 vm2 before 3.11.8 Sandbox Escape via NodeVM

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

CVE-2026-92955

vm2 before 3.11.8 contains a sandbox escape in its NodeVM component. Attackers can reach the host __proto__ getter/setter via console._stdout and console._stderr, then overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context , bypassing code generation...