cve-2026-33067

CVE-2026-33017 — Plantilla Nuclei para RCE sin autenticación en Langflow Plantilla Nuclei que detecta CVE-2026-33017 — una vulnerabilidad de ejecución remota de código sin autenticación en Langflow ≤ 1.8.2 accesible a través del endpoint público de construcción de flujos: POST...

CVE-2025-3248-POC

Langflow RCE 漏洞利用 - CVE-2025-3248 ⚠️ 免责声明 此代码仅严格用于教育和研究目的 。未经明确许可在系统上使用可能构成违法行为。 作者对此工具的任何误用或恶意行为概不负责 。 漏洞信息 CVE-2025-3248 - 严重 CVSS 评分：9.8 | EPSS 评分：92.57% | 发布时间：2025 年 5 月 22 日 受影响版本 存在漏洞： 所有版本 ≤ v1.3.0 已修补： v1.3.0 及以上版本 攻击向量 端点 /api/v1/validate/code 接受未经过滤的 Python 代码，并直接使用 exec 执行，无需身份验证。 漏洞代码...

BIT-OPENBAO-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2026:1767970357)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1767970357 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to...

CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl (CENTOS6:CLSA-2026:1781253209)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781253209 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1782299648)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1782299648 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2025_22668)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202522668 advisory. os/exec: Unexpected paths returned from LookPath in os/exec CVE-2025-47906 golang: archive/tar: Unbounded allocation when parsing GNU sparse map...

Rocky Linux 9 [CIQ] Security Update: go-filesystem / go-rpm-macros / go-rpm-macros-debuginfo / etc (crlsa-2025_22005)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202522005 advisory. os/exec: Unexpected paths returned from LookPath in os/exec CVE-2025-47906 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.4:CLSA-2026:1767613214)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1767613214 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS-STREAM8:CLSA-2026:1767800942)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1767800942 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query...

CVE-2026-101880

OpenClaw Windows Node versions before 2026.7.1 are vulnerable to an authorization bypass in the system.run exec-approval policy. The root cause is that the ExecShellWrapperParser fails to correctly split commands on pipe operators or extract command substitutions. This allows connected gateways o...

CVE-2026-101880 OpenClaw Windows Node before 2026.7.1 Authorization Bypass

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing...

CVE-2026-101880 OpenClaw Windows Node before 2026.7.1 Authorization Bypass

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing...

Malicious code in friendly-greeting-tools (PyPI)

Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...

MAL-2026-17416 Malicious code in friendly-greeting-tools (PyPI)

Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.6:CLSA-2025:1767027096)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767027096 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.5:CLSA-2026:1767609927)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1767609927 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

cve-2020-11651-exp-plus

使用bash执行 --exec 参数，原来的脚本是/bin/sh，所以有些命令不兼容比如bash反弹shell 2. 原来的代码会获取本地salt-master的版本来判断远程主机是否受影响，很明显的逻辑错误。我直接删掉了相关代码。 3. 添加批量扫描功能 python saltstack.py -b targetsfile.txt --threads 16 ,targetfile.txt内容如下 127.0.0.1:4506 192.168.1.1:4506 安装依赖 pip install salt...

CVE-2025-69212-PoC

CVE-2025-69212 — OpenSTAManager P7M 命令注入 PoC OpenSTAManager = 2.9.8 — 通过 ZIP 上传中的恶意 .p7m 文件名实现操作系统命令注入 文件： src/Util/XML.php:100 — 未净化的 $file 位于 exec 中 向量： /plugins/importFEZIP/actions.php → ZIP → .p7m 文件名 → exec"openssl smime ... -in "$file" ..." 使用方法 Listener nc -lvnp 4444 Exploit python3...

CVE-2021-27877-PoC

CVE-2021-27877 概念验证 本仓库包含针对影响 Veritas Backup Exec Agent 的 CVE-2021-27877 的原始 Rapid7 Metasploit 模块的修改版本。 在我的测试中，原始 Metasploit 模块成功将目标识别为易受攻击，但由于 payload 传递阶段失败，始终未能建立会话。然而，模块分析表明身份验证和底层命令执行功能正常工作。 为简化漏洞验证，我修改了该模块，通过易受攻击的 NDMP 命令执行功能直接执行用户提供的操作系统命令，而不是上传并执行 payload。这使得无需依赖反向 shell 或 payload...