CVE-2026-86063 Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Gi...

CVE-2026-86063 Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Gi...

CVE-2026-86063

The agentic coding tool Claude Code (and the Claude Desktop plugin) is vulnerable to a plugin hash pinning bypass prior to version 2.1.179 . The flaw exists because the installation flow executes git checkout for a marketplace-pinned commit without verifying that the resulting HEAD matches the ex...

CVE-2026-86063

Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Gi...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994

The Qwik JavaScript framework is vulnerable in versions prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37 . The root cause is a flaw in default server-side qwik-json deserialization where ResourceSerializer.$fill$ passes resource._resolved to Promise.resolve without rejecting atta...

CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

EUVD-2026-99978

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

cryptovenom

CryptoVenom CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions,...

CVE-2005-1794Scanner

CVE-2005-1794Scanner Can be used to scan several targets vulnerable to CVE-2005-1794. Credit to @daveysec and his orginal script available at https://github.com/RhinoSecurityLabs/Security-Research/blob/master/tools/python/CVE-2005-1794-check.py Disclaimer I take not responsibility for your use of...

sqlite-values-union

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-values-union sqlite-values-union Class: Crash Reach: Local SQLite 3.53.4 b09c88c - Hwaci Default VALUES uses a co-routine. WITH or schema reload, or a non-constant row forces sqlite3MultiValues onto UNION ALL...

CVE-2019-15107-Scanner

Webmin CVE-2019-15107 Vulnerability Scanner A multi-threaded Python scanner to detect Webmin servers vulnerable to CVE-2019-15107 authenticated RCE vulnerability in Webmin versions 1.890 through 1.920. Description This tool scans a list of Webmin servers provided in CSV format and checks for the...

CVE-2024-21626-runcPOC

Vulnerability Reproduction CVE-2024-21626 docker runc Escape Vulnerability 1. Vulnerability Overview Vulnerability Name| docker runc Escape Vulnerability ---|--- CVE ID| CVE-2024-21626 Disclosure Date| 2024-01-31 Characteristic| / Affected Versions| runc @ v1.0.0-rc93, 1.1.11 2. Exploitation &...

CVE-2026-110240

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...

CVE-2026-110240

The software Lancet versions through 2.3.9 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass in the netutil.IsInternalIP function. The root cause is the misclassification of IPv6 private, link-local, CGNAT, and transition addresses as external addresses. Attackers can exploi...

EUVD-2026-99024

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...

CVE-2026-110240 Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...

CVE-2026-110240 Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...