CVE-2026-22679

CVE-2026-22679: Weaver E-cology 무인증 RCE dubboApi 디버그 엔드포인트 -critical TL;DR Weaver E-cology 10.0빌드 20260312 이전 버전에는 /papi/esearch/data/devops/dubboApi/debug/method 엔드포인트에 치명적인 무인증 원격 코드 실행 취약점이 존재합니다. 공격자는 인증 없이 interfaceName 및 methodName POST 파라미터를 통해 임의의 명령을 주입할 수 있으며, 이를 통해 시스템 전체를 장악할 수 있습니다...

CGA-9Q7F-6XH5-37F7

Bulletin has no description...

EUVD-2026-75124

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73787

HPE CPPM (Campus Policy Manager) contains a vulnerability in its web interface that allows an authenticated remote attacker to access directory information on the system, which can escalate to arbitrary command execution on the underlying operating system via an arbitrary file write mechanism (as...

CVE-2026-73787 Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73787 Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-21020-Protobuf-Message-Parsing-Polymorphic-Deserialization-Vulnerability

CVE-2026-21020 – Protobuf 메시지 파싱 다형성 역직렬화 취약점 프로그램 코드 Python with protobuf root@kitploit: protovuln.py - Insecure handling of Any type import addressbookpb2 Example protobuf Simulated deserialization that trusts an injected typeurl from google.protobuf import anypb2 anymsg = anypb2.Any...

EUVD-2026-75122

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73769 Authenticated Remote Code Execution in CPPM Web Interface

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73769

CVE-2026-73769 affects the web-based management interface of HPE CPPM systems. An authenticated remote attacker with high-level privileges can achieve remote code execution , allowing arbitrary command execution on the underlying operating system. The CVSS 3.1 score is 7.2 (HIGH) with a vector of...

CVE-2026-73769 Authenticated Remote Code Execution in CPPM Web Interface

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-60004

CVE-2026-60004 — Gitea diffpatch RCE Gitea diffpatch 엔드포인트 원격 코드 실행 PoC. 저장소 쓰기 권한이 있는 계정공개 등록 인스턴스에서는 가입만 하면 됨이면 서버에서 Gitea 서비스 계정 으로 임의의 shell 명령을 실행할 수 있습니다. 취약점 개요 POST /api/v1/repos/owner/repo/diffpatch는 공유된 bare 임시 클론 저장소 에서 공격자가 제어하는 패치를 적용합니다: root@kitploit: git apply --index --recount...

Malicious code in bq-sdist-probe-vrp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f61d3e118672e10f0dc02115acd8235c3b356d75e7cb59a69e26fec28070c814 setup.py executes at pip install time and performs installer-side credential and host reconnaissance. It queries the GCE/GCP metadata service at...

MAL-2026-16099 Malicious code in bq-sdist-probe-vrp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f61d3e118672e10f0dc02115acd8235c3b356d75e7cb59a69e26fec28070c814 setup.py executes at pip install time and performs installer-side credential and host reconnaissance. It queries the GCE/GCP metadata service at...

MAL-2026-16098 Malicious code in bq-build-probe-vrp-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65 setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the G...

Malicious code in bq-build-probe-vrp-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65 setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the G...

CVE-2026-1312

CVE-2026-1312 は、危険度の高い Django SQL インジェクションの脆弱性です。QuerySet.orderby でドットを含む列エイリアスを使用し、FilteredRelation と組み合わせて辞書展開により動的にクエリを構築する際、攻撃者によって悪意のある SQL が注入される可能性があります。 影響を受けるバージョン: Django 6.0 ブランチの 6.0.2 より前のバージョン Django 5.2 ブランチの 5.2.11 より前のバージョン Django 4.2 ブランチの 4.2.28 より前のバージョン 環境の起動...

CVE-2020-10199

CVE-2020-10199 PT를 진행하던 중 대상 환경에 Nexus Repository Manager가 구축되어 있는 것을 만났고, 여러 시행착오를 겪은 끝에 결국 Shell을 획득할 수 있었다. 나중에 참고할 수 있도록 간단히 기록해 둔다. 대상 버전: Sonatype Nexus Repository Manager OSS 3.20.1-01 PoC로 Code Execution을 테스트하여 취약점이 존재함을 확인했다. 참고: 이때는 로그인된 세션 상태였다. 마침 대상 환경에서 default credential 문제를 발견했기...

CVE-2026-31431

Copy Fail CVE-2026-31431 - 종합 분석 보고서 1. 취약점 개요 취약점 이름: Copy Fail CVE 식별자: CVE-2026-31431 발견자 / 작성자: Xint Code Research Team Theori 연구원 Taeyang Lee의 초기 기반 연구를 바탕으로 구축됨. "Copy Fail"은 Linux 커널의 authencesn 암호화 템플릿에서 발견된 심각한 로직 취약점입니다. 이 취약점을 통해 권한이 없는 로컬 사용자가 시스템의 모든 읽기 가능한 파일의 페이지 캐시에 결정적이고 통제된 4바이트...

CVE-2026-0770

🚀 CVE-2026-0770 – Langflow RCE execglobal PoC Langflow의 원격 코드 실행 취약점 📌 영향을 받는 소프트웨어 이 취약점은 다음에 영향을 미칩니다: Langflow 🧠 취약점 개요 CVE-2026-0770 은 다음 엔드포인트의 원격 코드 실행RCE 취약점입니다: root@kitploit: /api/v1/validate/code AUTOLOGIN=true 및 기본 자격 증명이 활성화된 경우, 공격자는 다음을 수행할 수 있습니다: 🔓 인증 우회 💻 임의 시스템 명령 실행 ⚠️ 서버 완전 장악 ...