CVE-2026-82710 Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usagerules allows a malicious package publisher to inject terminal control sequences into the output of mix usagerules.searchdocs. mix usagerules.searchdocs searches Hex documentation through...

EUVD-2026-72589

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usagerules allows a malicious package publisher to inject terminal control sequences into the output of mix usagerules.searchdocs. mix usagerules.searchdocs searches Hex documentation through...

EEF-CVE-2026-82710 Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage\rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage\rules.search\docs. mix usage\rules.search\docs searches Hex documentation through...

CVE-2023-26818

Disclaimer This exploit has been created solely for the purposes of research and for the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The author and the owner of the script disclaim any responsibility or liability for a...

KVM-Januscape

KVM-XJ Hot Patch dumptool.py automatically finds offsets; how to use it? Just read the code. Vulnerability Overview CVE-2026-53359 Januscape is a use-after-free UAF vulnerability in the Linux kernel KVM shadow MMU. Lurking time : 16 years August 2010 to July 2026 Affected range : All Intel/AMD x8...

PT-2026-86964

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage rules.search docs. mix usage rules.search docs searches Hex documentation through...

deepce

deepce root@kitploit: . == === /"""""""""""""""""""/ === / ===- \ X / \ \ / \/ / / / / / / / / \ ENUMERATE / // / / / // / / / ESCALATE ,/// ./// ESCAPE // 网站 Docker 枚举、权限提升与容器逃逸（DEEPCE） 为了与尽可能多的容器兼容，DEEPCE 使用纯 sh 编写，无任何依赖。如果可用，它会使用 curl、nmap、nslookup 和 dig 等额外工具，但在大多数情况下并不依赖它们进行枚举。...

CVE-2025-6558-exp

CVE-2025-6558 - Google Chrome ANGLE/GPU Sandbox Escape...

Browser-Pwning-

Browser-Pwning 一份条理清晰、结构完善的文档，帮助你入门 chrome 漏洞利用 & v8 漏洞利用 文档结构 本文档的组织方式 1. 动机 2. 实际学习材料 动机 浏览器是当今最常用的技术之一。在每一台现成的计算机上，只要我们即插即用，就会看到已安装的浏览器。因此，从攻击者和威胁模型的角度来看，如果攻击者能够通过恶意页面攻破浏览器，那将是非常有回报的。基于上述理由，我选择研究 Google 的 JavaScript 引擎，尤其是 v8。 鉴于 v8 项目规模庞大，我选择以解释器（即 d8）作为起点。尽管针对 d8 已经进行了大量研究，但我们仍希望至少能找到一个...

tplmap

Tplmap 本项目已不再维护。只要不破坏测试套件，我会合并新的PR。 Tplmap 协助利用代码注入和服务器端模板注入漏洞，借助多种沙箱逃逸技术，获取底层操作系统的访问权限。 该工具及其测试套件旨在研究 SSTI 漏洞类别，并作为 Web 应用程序渗透测试中的进攻性安全工具使用。 沙箱逃逸技术源自 James Kett 的服务器端模板注入：现代 Web 应用的 RCE、其他公开研究 1 2，以及本工具的原創贡献3 4。 它可以利用多种代码上下文和盲注入场景。它还支持 Python、Ruby、PHP、Java 中的类似 eval 的代码注入以及通用的非沙箱模板引擎。 服务器端模板注入...

CVE-2026-82584

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - ServiceNow 预认证 RCE 漏洞利用框架与 PoC 验证器 🔥 ServiceNow AI 平台 — JavaScript 注入 → 沙箱逃逸 → RCE → Root 提权 漏洞利用框架与安全验证器 仅供授权安全测试使用。 ⚖️ 法律免责声明与负责任使用 本工具仅供教育和授权渗透测试目的使用。 作者和贡献者不对因使用本软件而造成的任何滥用或损害负责。用户须自行确保在测试前已获得目标所有者的明确书面许可。根据《计算机欺诈与滥用法》（CFAA）及全球类似法律，未经授权访问计算机系统属于违法行为。 使用本软件即表示您同意：...

vesta

A static analysis of vulnerabilities, Docker and Kubernetes cluster configuration detect toolkit based on the real penetration of cloud computing. English · 简体中文 Overview Vesta is a static analysis of vulnerabilities, Docker and Kubernetes cluster configuration detect toolkit. It inspects...

copy_fail

copyfail Research Notes CVE-2026-31431 English 简体中文 This repository is a defensive research workspace for studying the Linux copyfail vulnerability tracked as CVE-2026-31431. The goal of this repository is to preserve analysis notes, document impact, and support safe local assessment. It is not...

CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...

EEF-CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's...

CVE-2026-82584

ash-project igniter (an Elixir build tool) is vulnerable to terminal escape sequence injection in its mix igniter.install confirmation panel. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal...

CVE-2025-9074

CVE-2025-9074 – Docker Desktop Windows 容器→主机写入（通过暴露的引擎 API） 作者： w01f 状态： 概念验证（仅用于教育/授权测试） 概述 本项目演示了 CVE-2025-9074 的概念验证，该漏洞涉及 Docker Desktop for Windows 某些版本中的配置错误/暴露问题——Docker 引擎 HTTP API （位于 http://192.168.65.7:2375）可从容器内访问（有时也可通过 SSRF 访问），使攻击者能够创建一个带有 bind mount 的容器，挂载到 Windows 主机驱动器，并向主机写入文件。...

CVE-2024-6778-POC

CVE-2024-5836 / CVE-2024-6778 This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within the Chromium web browser which allowed for a sandbox escape from a browser extension. To run these, you must be on a version of Chromium older tha...

ITScape

ITScape: Escape de invitado a anfitrión en KVM/arm64 Resumen Este documento describe la vulnerabilidad ITScape CVE-2026-46316 reportada y parcheada por Hyunwoo Kim @v4bel. Es una vulnerabilidad de escape de KVM que permite a un invitado escapar al anfitrión en un entorno KVM/arm64 y ejecutar...