CVE-2026-86843 Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

CVE-2026-25253

CVE-2026-25253 OpenClaw 一键RCE ★ CVE-2026-25253 OpenClaw 一键远程代码执行 PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e 描述 CVE-2026-25253：OpenClaw 认证令牌泄露漏洞 OpenClaw（又称 clawdbot 或 Moltbot）在 v2026.1.29 之前，攻击者可通过向 Control UI 提供精心构造的 gatewayUrl...

CVE-2026-8932

🚨 CVE-2026-8932 - 最古のlibcurlセキュリティバグ libcurlにおける不完全なmTLS構成マッチング libcurlでこれまでに修正された最古のセキュリティ脆弱性——25年以上も気づかれずにいた。 📖 概要 CVE-2026-8932 は libcurl におけるセキュリティ脆弱性で、相互TLS（mTLS） クライアント認証設定が変更された後でも、ライブラリが誤って既存のTLS接続を再利用する可能性があります。 一部の秘密鍵関連オプション...

fortios-auth-bypass-check-CVE-2024-55591

CVE-2024-55591 Fortinet FortiOS 認証バイパスの脆弱性動作検出 動作中の検出 python CVE-2024-55591-check.py --target 192.168.1.10 --port 443 / | | |\ \ \ / / \ \ / | | \| | / \ / / \ \ \ / / | | \ \| Y | | \ / | | \ // || \\ ||| | \ / \// || \ \ \ CVE-2024-55591.py Fortinet FortiOS Authentication Bypass...

CVE-2019-14224

CVE-2019-14224：Alfresco Community中的已认证远程代码执行 通过利用Alfresco应用程序中的多个组件，观察到一条漏洞利用链，允许攻击者实现远程代码执行。攻击者必须使用Alfresco来： 将恶意的Solr配置文件上传到已知/可被发现的位置 创建一个Solr核心，该核心将触发从受害者到攻击者的JMX连接 托管一个恶意的RMI服务器，该服务器将发送一个恶意Java对象，导致反序列化和代码执行 NVD披露： 此漏洞的披露可在此处找到。 要求： 此漏洞需要： 访问Alfresco管理控制台的权限和有效的用户凭据 访问Alfresco WebDAV或Alfresc...

cve-2026-41042

CVE-2026-41042: Apache Gravitino 1.2.1 RCE no autenticado Prueba de concepto autocontenida, solo con la biblioteca estándar, para CVE-2026-41042: ejecución remota de código no autenticada en Apache Gravitino anterior a 1.2.1 mediante el ajuste de conexión INIT de H2 JDBC. Sin cabeceras de...

CVE-2026-98070

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS subsystem. Due to improper synchronization during TCP connection path resets, transmit operations can run concurrently while connection state is being modified. An attacker could exploit this timing window during connection...

PT-2026-102660

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A malicious remote peer can flood the local QUIC stack with NEW CONNECTION ID frames by bypassing the limit check on the number of connection IDs the remote stack can use. The local stack...

CVE-2024-34693

CVE-2024-34693 漏洞利用 此仓库包含一个用于利用 Apache Superset 中 CVE-2024-34693 漏洞的复杂 Python 脚本。该脚本设置一个恶意 MySQL 服务器，并创建恶意 MariaDB 连接，以从目标系统中窃取指定文件的内容。 !\Screenshot1.png\https://raw.githubusercontent.com/Mr-r00t11/CVE-2024-34693/main/img/Screenshot1.png 描述 CVE-2024-34693 漏洞允许能够创建任意数据库连接的攻击者执行 LOAD DATA LOCAL...

CVE-2026-98008

A flaw was found in the Linux kernel's Cadence MACB ethernet driver. A local user with administrative privileges could cause a denial of service DoS by triggering a driver unbind operation or an initialization failure on a device configured with a fixed-link connection. In this configuration, the...

CVE-2026-12717

A flaw was found in BigQuery Data Transfer Service. An authenticated attacker can achieve arbitrary code execution within the connector container by supplying crafted Java Database Connectivity JDBC connection string parameters. Successful exploitation can further allow the attacker to escalate...

CVE-2023-38146-Poc

ThemeBleed CVE-2023-38146 エクスプロイト Windows 11 テーマ の PoC https://github.com/gabe-k/themebleed に大きく触発されました。これは Windows でのみ動作するため、自分で作成することにしました。 impacket の smbserver.py から修正したコードを使用しています https://github.com/fortra/impacket/blob/master/impacket/smbserver.py 参考:...

CVE-2020-14292

CVE-2020-14292：COVIDSafe 应用中的蓝牙传输问题 作者：Alwen Tiu，澳大利亚国立大学 最后更新：2020-09-08 摘要 在适用于 Android 的 COVIDSafe 应用 1.0.21 及更早版本中，GATT 连接中不安全地使用蓝牙传输选项，允许攻击者诱骗该应用通过蓝牙 BR/EDR 传输建立连接，从而在未经授权的情况下泄露受害者手机的公共蓝牙地址，绕过手机上的蓝牙地址随机化保护。此问题通过 CVE-2020-14292. 进行跟踪。 技术描述 该问题的原因在于 startWork 函数， 该函数使用 connectGatt 建立 GATT...

CVE-2018-10583

CVE-2018-10583 当 LibreOffice 6.0.3 和 Apache OpenOffice Writer 4.1.5 自动处理并启动嵌入在恶意文件中的 SMB 连接时，会发生信息泄露漏洞，如 ".odt XML 文档" 中 "office:document-content" 元素内的 "xlink:href=file://192.168.0.2/test.jpg" 所示。 http://bit.ly/2w9mU1n...

CVE-2026-98152

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over Fabrics RDMA Remote Direct Memory Access target subsystem. When pending disconnecting queues exceed the backlog threshold, the connection handler fails to release newly allocated queue structures and associated network...

CVE-2024-14029

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

CVE-2024-4879

CVE-2024-4879 CVE-2024-4879.py es un script de Python diseñado para detectar vulnerabilidades específicas en instancias de ServiceNow y volcar los detalles de conexión a la base de datos si se encuentra la vulnerabilidad. Esta herramienta es particularmente útil para investigadores de seguridad y...

libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse

A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...

curl: curl: Insecure connection establishment due to TLS configuration mismatch

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security TLS configuration of the new transfer does not match the existing connection,...

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...