DEBIAN-CVE-2026-111766

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

ditto

ditto Powershell Obfuscator Ditto is a Powershell and JavaScript obfuscator base on tree-sitter-powershell and tree-sitter-javascript. Command Line Usage Basic Command Structure ditto-cli options CLI Arguments & Options Short Option| Long Option| Description ---|---|--- -h| --help| Display help...

EXPLOIT-CVE-2026-40901

DataEase — Unauthenticated RCE via a 4-vulnerability chain CVE-2026-40901 & friends Auth bypass → JDBC blocklist bypass arbitrary file read → SQL injection → Java deserialization in Quartz → remote code execution asroot. Self-contained local lab Docker + working PoC. Fixed in DataEase v2.10.21...

rpc-rce.py

rpc.py RCE Exploit CVE-2022-35411 This is an updated and improved exploit for CVE-2022-35411 , targeting vulnerable versions of rpc.py Original exploit by : Elias Hohl Enhanced by : x7331 for usability, portability, and automation Vulnerability Summary The vulnerability lies in rpc.py's unsafe...

CVE-2026-11374-check

CVE-2026-11374 ManageEngine AD360 Precondition Detection Script A detection script for the exploit precondition of CVE-2026-11374, a predictable SSO-ticket flaw that leads to unauthenticated account takeover across the ManageEngine AD360 suite. The four in-scope products share the...

proftpd-CVE-2026-42167-analysis

CVE-2026-42167 — ProFTPD modsql SQL Injection / Auth Bypass / RCE Independent reproduction, code-level root-cause walkthrough, and a frank exposure analysis for CVE-2026-42167 — the isescapedtext bypass in ProFTPD's modsql logging pipeline disclosed by ZeroPath Research and fixed in ProFTPD 1.3.9...

Google may add your number to all your accounts: How to stop it

As Android Central reports, users have received unexpected emails telling them their phone number has been verified for secondary Google accounts. Like me and many others, you may have one Google account for everyday use, another for work, and a third for things you would rather keep separate. Bu...

CVE-2024-52794-Discourse-Stored-XSS

CVE-2024-52794 – Stored Cross-Site Scripting XSS in Discourse Summary I discovered a stored cross-site scripting XSS vulnerability in Discourse, an open-source forum platform. The vulnerability allows an attacker to execute arbitrary JavaScript in the victim’s browser by injecting a malicious...

CVE-2026-5530

CVE-2026-5530 Ollama SSRF via OCI registry redirect with full response exfiltration. Writeup: https://davidrochester.com/posts/cve-2026-5530 Disclosure Ollama was contacted multiple times with no response. Usage Three modes: enum, exfil, and probe. Enum Finds live internal endpoints reachable fro...

CVE

cve: A collection of code pertaining to CVE-2016-0728 various authors Excerpts from Linux, showing the evolution and fix of the bug Exploit code from Perception Point with added comments that explain what each line does. A short script that uses the leak to increment usage count, useful for...

CVE-2026-0911

CVE-2026-0911 — Hustle Module Import PoC A research / pentest helper tool that tests the upload behavior via the authenticated module import endpoint for the WordPress plugin Hustle wordpress-popup, WPMU DEV under CVE-2026-0911. The CVE-2026-0911.py script in this repository or file set should on...

CVE-2026-113357

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

DEBIAN-CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-113357

The @e2e-dev/github package version before 0.4.1 is vulnerable to an improper authorization vulnerability (CWE-863) that allows for CI report hijacking . The root cause is located in the findComment and upsertComment functions within post.ts, which fail to verify the comment author. Consequently,...

CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

CVE-2026-113357

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

EUVD-2026-104928

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

cve-2023-6931-pipa

CVE-2023-6931 — Xiaomi Pad 6 pipa Privilege Escalation and Disabling SELinux The final version of the exploit used on the device, organized separately in this directory. Target Device Xiaomi Pad 6 / pipa / SM8250 System HyperOS OS2.0.20.0.UMZCNXM Kernel 4.19.157-perf-g240e1d0a5f52 Start adb shell...