CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

DEBIAN-CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

CVE-2026-101913

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

setcred

FreeBSD setcred2 — 연구 아티팩트 이 하위 디렉토리는 FreeBSD 14.x 커널의 setcred2 스택 버퍼 오버플로우에 대한 분석 문서와 작동하는 익스플로잇을 수집합니다. 취약점 자체는 setcred.txt에 완전히 문서화되어 있습니다. 간단히 말하면: kernsetcredcopyinsuppgroups는 groups가 gidt 일 때 sizeofgroups를 사용하여 고정 크기 커널 스택 배열로의 copyin에 대해 4바이트가 아닌 8바이트 스트라이드를 생성합니다. 오버플로우는 권한 검사 전에 권한이 없는...

CVE-2026-101912 ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

CVE-2026-93828

A flaw was found in the Linux kernel's exFAT file system. A local user capable of mounting a corrupted or maliciously crafted storage volume can trigger an integer calculation error when the system processes an uppercase translation table with a size of zero. This failure causes the kernel to ent...

GO-2026-6488 OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga

OpenFGA: ListUsers returns a deliberately-excluded user when a but not exclusion under a type-bound wildcard is intersected and with another relation that also grants that user in github.com/openfga/openfga...

CVE-2023-40130

https://wrlus.com/android-security/bindservice-error-handle/...

CVE-2024-10924

CVE-2024-10924 の POC Really Simple Plugins WordPress プラグインのREST APIにおけるエラーハンドリングの脆弱性（バージョン9.0.0から9.1.1.1まで、両端を含む）により、二要素認証が有効な場合、攻撃者は認証をバイパスし、既存のユーザーまたは管理者アカウントを乗っ取ることが可能です。 親切なことに、プラグインのバージョン9.1.1.1も同梱されています。解凍して wp-content/plugins フォルダにアップロードするだけです。プラグインを有効化し、2FAを有効にするのを忘れないでください。 必要条件 pip...

CVE-2021-40353

CVE-2021-40353 CVE-2021-40353 openSIS 8.0 SQLインジェクションの脆弱性 https://vulners.com/cve/CVE-2021-40353 openSIS 8.0には、MySQLまたはMariaDBをアプリケーションデータベースとして使用する場合にSQLインジェクションの脆弱性が存在します。攻撃者はUSERNAMEパラメータを介してSQLコマンドを発行できます。 脆弱性のあるPHPページ: index.php - USERNAMEパラメータ 脆弱性のあるペイロード ' - データベース情報とともにエラーを生成します " -...

CVE-2019-20372

CVE-2019-20372 이 저장소는 교육 목적으로만 제공됩니다. /server 취약한 서버 실행: ./server.sh /exploit.py 익스플로잇 스크립트 실행: python3 exploit.py 중요! https://blkcipher.pl/assets/pdfs/2019-12-10-errorpagerequestsmuggling.pdf https://github.com/vuongnv3389-sec/CVE-2019-20372 왜 이 저장소인가? 버프스위트가 두 번째 응답을 잡지 못하고, vuongnv3389-sec의 저장...

CVE-2021-3560

CVE-2021-3560 polkit의 race condition을 통한 권한 상승. 취약점 설명 CVE-2021-3560은 polkit의 race condition으로, 인증되지 않은 로컬 사용자가 root 권한을 얻을 수 있게 합니다. 이 취약점은 polkit이 연결이 끊어졌을 때 D-Bus 오류를 처리하는 방식에 존재합니다. 타이밍 결정 최적의 타이밍을 결정하려면 다음 명령을 실행하세요: time dbus-send --system --dest=org.freedesktop.Accounts --type=methodcall...

Off-by-one Error

org.apache.tomcat, tomcat-catalina is vulnerable to an Off-by-one Error. The vulnerability is due to rewrite processing restarting at the second rule instead of the first, which allows an attacker to potentially bypass intended rewrite rules or cause unintended request processing...

CVE-2023-36874

CVE-2023-36874 概念実証（PoC） CVE-2023-36874 脆弱性の教育的かつ防御的な調査実装であり、Windows エラー報告（WER）コンポーネント内のローカル権限昇格（LPE）の欠陥を実証するものです。 ⚠️ 免責事項 このリポジトリおよび提供されるソースコードは、教育目的、セキュリティ研究、および防御的監査のためだけ を意図しています。明示的な許可なしに、本番システムや環境でこのコードを実行しないでください。作者は、この素材を使用して行われた誤用、損害、または違法行為について一切の責任を負いません。 🔍 脆弱性の概要 CVE-2023-36874...

CVE-2026-18825

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

EUVD-2026-88239

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825 Origin validation error in the connect-xcors npm package

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2026-18825

The connect-xcors npm package contains an Origin Validation Error within its middleware. This flaw allows an attacker to bypass origin verification , potentially enabling the execution of cross-domain authenticated requests . The vulnerability has a CVSS 4.0 base score of 5.3 (MEDIUM) . No specif...