NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

gitbleed_tools

GitBleed Tools - for extracting data from mirrorred git repositories About This repo contains shell scripts that can be used to download and analyze differences between cloned and mirror Git repositories. For more information about the underlying quirk in Git behavior, please visit read our blog...

EUVD-2026-105148

Vitest: Code injection via unauthenticated manual mock registration...

wsb-detect

⏳ wsb-detect wsb-detect enables you to detect if you are running in Windows Sandbox "WSB". The sandbox is used by Windows Defender for dynamic analysis, and commonly manually by security analysts and alike. At the tail end of 2019, Microsoft introduced a new feature named Windows Sandbox WSB for...

CVE-2026-114125

A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...

csw-slides-2024

Developing Secure Software in 2024 Abstract As humanity increases its dependence on computer systems, the need for safe and secure software becomes paramount. Today, everything from planes, trains, and automobiles to toothbrushes and cooktops contain a multitude of tiny computers. Each of these...

Exploit_Development

Proof-of-Concepts for my CVEs CVE-2022-3436 - Online Student Clearance System v1.0 - CVE-2022-3436.py...

HackerLife.exe

HackerLife.exe Write up about an exploit chain failed to be fully weaponised and experience when trying to tryin to sell your first nday. So what this story about ? Our quote on qute "life experience in 2025 as young security researcher trying to make in in a ever changing and compilated...

bluekeep_CVE-2019-0708_poc_to_exploit

Note: This project has been archived as actual exploits have been developed elsewhere with better success. https://blog.rapid7.com/2019/09/06/initial-metasploit-exploit-module-for-bluekeep-cve-2019-0708/ Badges bluekeepCVE-2019-0708poctoexploit Porting BlueKeep PoC from @Ekultek & @umarfarook882 ...

CVE-2019-0708-RCE

CVE-2019-0708-RCE CVE-2019-0708-RCE We are working on a fully functional exploit join us https://discord.gg/4kc72bZ...

CVE-2019-5420

CVE-2019-5420 PoC A remote code execution vulnerability in development mode Rails 5.2.2.1, 6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code...

py

if you find any bugs report it at Github user issues Still in development Support win7 to win11（last） MCP 配置 / MCP 使用方法 PYArkClient 内置一个 MCP Streamable HTTP 服务端 ，任意 MCP 客户端（Claude Code / Claude Desktop / CodePilot 等）都能调用它提供的内核级 ARK 工具（进程 / 线程 / 模块 / 内存 / SSDT / 回调 / 注入 / dump 等）。 1. 前置条件 以 管理员...

CVE-2026-32662

CERT/CC VU653116 | CISA Advisory ICSA-26-055-03 | All CVEs | Case Repository CVE-2026-32662: Active Debug Code in Production Advisory Field| Value ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Activ...

CVE-2026-114071

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

CVE-2026-114071

Versions of Trigger.dev prior to 4.5.12 are vulnerable to an authorization bypass within the waitpoint complete route. The root cause is a failure to perform a per-user environment ownership check, allowing authenticated project members to interact with other members' DEVELOPMENT environment wait...

CVE-2026-114071 Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

CVE-2026-114071

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

EUVD-2026-107022

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

EUVD-2026-105911

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Siebel Approval Manager. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development...

EUVD-2026-105871

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Integration - Scripting. Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes...