CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

SharpSploitConsole

SharpSploitConsole 用于与 @cobbrio 发布的 SharpSploit 交互的控制台应用程序 https://github.com/cobbr/SharpSploit SharpSploit 是由 @cobbrio 编写的工具，它将信息安全社区的许多技术/C代码整合到一个优秀的 DLL 中。这真的很棒，所以去看看吧！ 描述 SharpSploit Console 只是一个快速的概念验证二进制文件，旨在帮助 C 经验较少的渗透测试人员或红队成员体验 SharpSploit 的精彩之处。通过遵循以下说明，您应该能够将 SharpSploit.dll 和...

CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

🚨 CVE-2026-2472-Vertex-AI-SDK-Google-Cloud - 简单概念验证工具 🛠 关于此应用程序 此工具针对安全漏洞 CVE-2026-2472 提供了技术性概念验证 PoC。该漏洞影响 Google Cloud Platform 的 Vertex AI Python SDK。它涉及 SDK 中与 Jupyter 和 Colab 笔记本一起使用的部分所存在的未经验证的存储型跨站脚本 XSS 漏洞。 该软件帮助您了解此漏洞是如何被触发的。它可在 Windows 上运行，无需编程知识。您可以在自己的系统上安全地进行测试，以了解相关风险。 🖥 系统要求...

csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...

csf

ArmourBird CSF - 容器安全框架 注意： CSF 客户端正在积极开发中，并正在转换为 GoLang 以获得更好的性能和架构。 目录 1. 关于 2. 架构图 3. API - CSF 服务器 4. 安装/使用 5. 构建 Docker 镜像 6. 预览 7. 待办事项 8. 网站 9. Twitter 10. 参考资料 关于 ArmourBird CSF - 容器安全框架 是一个可扩展、模块化、API 优先的框架，用于对 Docker 安装和容器进行定期的安全监控，支持 CIS 及其他自定义安全检查。 ArmourBird CSF 采用客户端-服务器架构，因此分为两个组件：...

Qlik-View-12.60-Including-SR-Stored-Cross-Site-Scripting-CVE-2022-42248

QlikView = 12.60 Including SR Stored Cross Site Scripting CVE-2022-42248 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision: 1.0 Impact: Stored cross-site scripting in QlikView Aj...

CVE-2026-56290

CVE-2026-56290 - Compagebuilderck 批量利用工具 ⚠️ 免责声明 本工具仅供教育和授权安全测试使用。 未经授权访问计算机系统是违法的 请仅在你拥有或明确允许测试的系统上使用此工具 作者不对因使用本工具造成的任何误用或损害负责 使用本工具即表示你同意遵守所有适用法律和法规 更多免责声明可查看 Jenderal92 封面上的声明。你可点击 这里 !!! 查阅 📋 描述 CVE-2026-56290 是一个针对 Compagebuilderck Joomla 组件的批量利用工具。此漏洞允许远程攻击者通过无限制文件上传机制上传任意 PHP...

CVE-2026-43499-A36

CVE-2026-43499-A36 Port independiente de CVE-2026-43499 probado en dispositivo para el Galaxy A36 5G canadiense SM-A366W con el firmware exacto A366WVLS3AYG1, incluida la carga tardía de KernelSU y la integración con Root My Galaxy. Este repositorio contiene la parte nativa específica del...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681

ash-project ash_admin (Elixir admin panel) contains a query-parameter injection in the Table, DataTable, and Show components. Row-action URLs were built via raw string interpolation of the primary key without URL-encoding. Because the primary key is spliced last into the query string and Plug.Con...

EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ash\admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splici...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

EUVD-2026-68327

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2024-13869

CVE-2024-13869 Migración, copia de seguridad, staging – WPvivid 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever...

CureIAM

CureIAM 自动化清理 GCP 基础设施中权限过大的 IAM 账户 CureIAM 是一款易于使用、可靠且高性能的引擎，用于在 GCP 云基础设施上实施最小权限原则。它使 DevOps 和安全团队能够快速清理 GCP 基础设施中权限超出实际需求的账户。CureIAM 从 GCP IAM 推荐器获取建议和洞察，对其进行评分，并每天自动执行这些建议。它负责调度以及大规模运行这些执行任务的所有其他方面。它基于 GCP IAM 推荐器 API 和 Cloudmarker 框架构建。 主要特性 了解是什么让 CureIAM 具备可扩展性和生产级能力。 配置驱动 ：CureIAM...

Important: Red Hat Security Advisory: mingw-sqlite security update

An update for mingw-sqlite is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Re2Pcap

Re2Pcap: 在数秒内从原始HTTP请求或响应创建PCAP文件 Re2Pcap 是 Request2Pcap 和 Response2Pcap 的缩写。社区用户可以使用 Re2Pcap 快速创建 PCAP 文件，并针对 Snort 规则进行测试。 Re2Pcap 允许你快速为如下所示的原始HTTP请求创建 PCAP 文件： root@kitploit: POST /admin/tools/iplogging.cgi HTTP/1.1 Host: 192.168.13.31:80 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

Linux-Kernel-Dirty-Pipe-Exploitation-Logic-Bug-

Linux内核Dirty Pipe漏洞利用（逻辑错误） 作者：Antonius w1sdom https://www.bluedragonsec.com https://github.com/bluedragonsecurity Dirty Pipe（CVE-2022-0847）是Linux内核5.8至5.15.24版本中最严重的安全漏洞之一，由Max Kellermann于2022年发现。该漏洞允许普通用户（无特殊权限）覆盖本应为只读文件中的数据。 理解核心概念 在详细讨论Dirty Pipe之前，需要先了解一些Linux内核内部概念： 1. 分页（Paging）...