CVE-2026-91936 Flowise before 3.1.4 Script Injection via Docker Workflows

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

CVE-2026-91936 Flowise before 3.1.4 Script Injection via Docker Workflows

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

CVE-2026-91936 Flowise before 3.1.4 Script Injection via Docker Workflows

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

CVE-2026-55650

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...

CVE-2026-53966

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

cve-2026-24688

CVE-2026-24688 - pypdf - 循环引用拒绝服务漏洞 本仓库包含用于触发CVE-2026-24688的验证概念代码。 摘要 pypdf的目录（书签）解析逻辑中存在严重的拒绝服务漏洞。当处理带有循环目录引用的PDF时，解析器进入无限循环，持续分配内存，在我的机器上每秒消耗数百MB内存，并导致系统完全崩溃。 这是一个系统级的拒绝服务，而不仅仅是应用程序挂起。 目录 maliciouscircularoutline.pdf - 带有循环目录的利用PDF（754字节） createmaliciouspdf.py - 生成利用PDF的脚本 simplereadpdf.py -...

CVE-2026-46300

CVE-KERNEL · Linux Kernel LPE Chain Multi-CVE Local Privilege Escalation chain for Linux kernel vulnerabilities uid=1000 → root via xfrm-ESP, RxRPC, or Fragnesia page-cache write Overview CVE-KERNEL is a Python-based Local Privilege Escalation LPE tool that chains multiple Linux kernel CVEs to...

CVE-2026-85013

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

memdumper

memdumper memdumper lee la memoria de un proceso de macOS en ejecución bajo el entitlement de depurador de otro binario firmado. La idea es que taskforpid y ptrace se ejecuten como ese binario con entitlement, de modo que un EDR lo registre a él en lugar de a memdumper. por cenobyte...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

CVE-2025-24813 — Apache Tomcat Partial PUT Deserialization RCE...

Automate Asset Isolation: Your Last Resort to Meet Remediation Deadlines

Executive Summary Remediation deadlines slip for reasons outside your control: a patch does not exist yet, a patch is delayed, or a remediation attempt fails. The outcome is the same either way: the host stays unpatched and stays on the network. TruRisk Eliminate closes that window by isolating t...

samsung-bixby-command-execution-cve-2026-21055-improper-component-export

CVE-2026-21055 PoC — Exportación Incorrecta de Componentes de Samsung Bixby Prueba de concepto para CVE-2026-21055 : La exportación incorrecta de componentes de aplicaciones Android en Samsung Bixby anterior a la versión 4.0.70.8 permite a atacantes locales ejecutar comandos arbitrarios con...

RedTeamScripts

RedTeamScripts Repositorio con varios scripts de Red Team. kill.exe Estás realizando todo tipo de actividades durante un red team y tienes varios procesos ejecutándose que no quieres cerrar manualmente. kill.exe es para ti. Cópialo en C:\Windows\ y simplemente llámalo con el nombre del proceso qu...

EUVD-2026-78592

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966

In XWiki Platform (a generic wiki platform), the Live Data edit REST API fails to perform normal document-saving authorization checks when a user modifies page rights. Any user with edit permission can escalate to script right, enabling execution of potentially dangerous Velocity scripts or deliv...

CVE-2026-53966 XWiki Platform: Privilege escalation from edit to script right through Live Data editing

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966 XWiki Platform: Privilege escalation from edit to script right through Live Data editing

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966 XWiki Platform: Privilege escalation from edit to script right through Live Data editing

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

EUVD-2026-78591

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...

CVE-2026-55650 Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...