CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

EUVD-2026-91667

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486

The Next.js React framework (versions 16.0.0 through 16.3.8 ) contains an information disclosure vulnerability in the next dev development server . The server exposes a Model Context Protocol endpoint that fails to reliably restrict cross-site requests. This allows a malicious website visited by ...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2024-57522

CVE-2024-57522 - 在SourceCodester Packers and Movers Management System 1.0的Users.php中的存储型XSS漏洞 描述 本仓库包含针对SourceCodester 开发的Packers and Movers Management System 1.0 中一个存储型跨站脚本（XSS）漏洞的概念验证（PoC）。该漏洞存在于 Users.php端点，攻击者在创建用户时可以将恶意脚本注入用户名或姓名字段。该脚本随后存储在数据库中，当管理员查看用户列表页面时执行，可能导致恶意操作。 漏洞详情 CVE-2024-57522...

sentinel-mcp

SentinelMCP — AI驱动的网络防御系统 Google Cloud Hackathon 提交项目 — 由 Google Cloud Agent Builder Vertex AI Agent 编排的自主威胁检测与响应，基于 Gemini 2.0 Flash、模型上下文协议（MCP）和 Dynatrace 可观测性。 问题所在 安全团队在处理典型安全事件时，平均检测时间（MTTD）为 30分钟 ，平均修复时间（MTTR）为 4小时 。等到人工分析师检测到攻击、编写防火墙规则并部署完毕，损失早已造成。 解决方案 SentinelMCP 将 MTTD 缩短至 30秒，MTTR 缩短至...

cve-2021-45046

log4j RCE CVE-2021-44228 已在 2.15 版本中修复，但新发现了 CVE-2021-45046（引发 DoS）漏洞。 以下是测试结果。 测试环境 log4j-2.15.0 api, core JRE-1.8.0 jdk1.8.0151 Eclipse IDE Maven Project 1. Log4j RCE CVE-2021-44228 语法测试 - 无漏洞 2. 插入任意 ctx 对象名 - 无漏洞 3. 插入与接收 context 的对象相同名称 - 无限循环导致 DoS 4. 以 $jndi:ldap://127.0.0.1ldap 服务器地址 形式插入...

CVE-2026-11114-Node.js-vm-Sandbox-Escape-via-Proxy

CVE-2026-11114 – Escape de sandbox de Node.js vm mediante Proxy Código del programa Node.js // sandboxserver.js - Vulnerable VM sandbox const vm = require'vm'; const express = require'express'; const app = express; app.useexpress.json; app.post'/eval', req, res = const code = req.body.code; const...

MS09-050

MS09-050 — Exploit de Ejecución Remota de Código en SMBv2 CVE-2009-3103 La Vulnerabilidad Windows Vista y Server 2008 introdujeron SMBv2 con un nuevo controlador de kernel, srv2.sys. Este controlador no valida el campo Process Id High en las solicitudes de negociación SMB. Al enviar un valor...

CVE-2025-30374

CVE-2025-30374 Vulnerabilidad de contaminación de clases en Taipy que conduce a RCE, XSS, DoS y fuga de credenciales Resumen Se ha identificado una vulnerabilidad de contaminación de clases en Taipy v4.0.3 la última versión en el momento del descubrimiento. Esta vulnerabilidad permite a atacantes...

Apache Log4j2 - Remote Code Injection

Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. id: CVE-2021-45046 info: name: Apache Log4j2 - Remote Code Injection author: ImNightmaree severity: critical description: Apache Log4j2 Thread Context Lookup Pattern is...

VirtualLockSensorLPE

VirtualLockSensorLPE 描述 本地权限提升 PoC 利用程序，针对运行在 Windows 上的 Elliptic Virtual Lock Sensor 版本 3.1.60531.2，该传感器默认安装在特定 Lenovo 笔记本电脑型号上。允许通过更改注册表项的权限，从普通用户上下文在 SYSTEM 上下文中执行负载。 来自 Lenovo 的官方公告：https://support.lenovo.com/us/en/productsecurity/LEN-182738 请在使用前阅读注意事项。 如何构建 1. 使用 git clone --recursive 克隆仓库。...

Linux Distros Unpatched Vulnerability : CVE-2026-94485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

Linux Distros Unpatched Vulnerability : CVE-2026-94486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

AI_Security_Top

🛡️ AI-Security-Knowledge-Base Este es un proyecto sistemático de investigación en seguridad de IA que abarca un sistema de conocimiento completo, desde la teoría fundamental de algoritmos de aprendizaje automático hasta ataques de inyección de modelos de vanguardia, evasión de detección en IA y...

CollaboratorPlusPlus

CollaboratorPlusPlus Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado por Corey Arthur, [email protected] http://www.github.com/nccgroup/CollaboratorPlusPlus Este proyecto se publica bajo AGPL; consulta LICENSE para más información. Descarga desde las...

CVE-2026-19490-check

Citrix NetScaler SAML nFactor Context Authentication Bypass — Script de detección de vulnerabilidades Una comprobación de vulnerabilidad segura y no autenticada para CVE-2026-19490 , el bypass de autenticación previo a la autenticación en la ruta del proveedor de servicios SAML de Citrix NetScale...

CVE-2026-34621

Análisis del Zero-Day de Adobe Acrobat Notas de ingeniería inversa y material de apoyo para un análisis del modelo de confianza de JavaScript en Adobe Acrobat y su relación con la vía de abuso de zero-day reportada que involucra APIs privilegiadas de Acrobat. Descripción General Este repositorio...

log4j2-CVE-2021-45046

Aplicación vulnerable de muestra Log4j2 CVE-2021-45046 Versiones afectadas: todas las versiones desde 2.0-beta9 hasta 2.15.0 Esta aplicación se basa en una aplicación web Spring Boot vulnerable a CVE-2021-45046 Utiliza Log4j 2.14.1 a través de spring-boot-starter-log4j2 2.6.1. Ejecución de la...