CVE-2026-101169

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

CVE-2026-101169

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

CVE-2026-10520

🎯 CVE-2026-10520 および CVE-2026-10523 - Ivanti Sentry プリ認証リモートコード実行 + 認証バイパス 作成者: Ashraf Zaryouh "0xBlackash" 📌 概要 Ivanti Sentry （旧MobileIron Sentry）に影響する2つの重大な脆弱性： CVE-2026-10520 → CVSS 10.0 - プリ認証OSコマンドインジェクション（root権限でのRCE） CVE-2026-10523 → CVSS 9.9 - 認証バイパス...

CVE-2024-26169-Detail-1

CVE-2017-11882-metasploit これは、以下のPOCを使用してCVE-2017-11882を悪用するMetasploitモジュールです： https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about. インストール 1. cve201711882.rb を /usr/share/metasploit-framework/modules/exploits/windows/local/ にコピーします。 2. cve-2017-11882.rtf を...

CVE-2026-35273

CVE-2026-35273 このセキュリティアラートは、Oracle PeopleSoft PeopleTools の脆弱性 CVE-2026-35273 に対処するものです。Oracle PeopleSoft Enterprise Applications のお客様もこの脆弱性の影響を受ける可能性があります。この脆弱性は認証なしでリモートから悪用可能です。悪用に成功した場合、リモートでコードが実行される可能性があります。 ⚡ 基本的な使い方 このプロジェクトは、安全かつ許可された環境でのみ使用してください。例： ローカル仮想マシン Docker コンテナ 隔離されたラボ環境...

cisco-CVE-2023-31488

关于 安全研究员：ly1g3，ly1g3attuta.io GPG 指纹：https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 概述：通过电子邮件实现零点击 RCE 提权至 root - 远程代码执行/内存损坏/ROP 链 CVE：CVE-2023-31488 时间线： 发现 - ly1g3 报告 - ly1g3 修复 - Cisco 和 Lexmark 漏洞分析 在对 Cisco 邮件安全设备（ESA）进行模糊测试时，我在 Lexmark Perceptive...

CVE-2026-53753-Crawl4AI-RCE

CVE-2026-53753 — Crawl4AI 未認証リモートコード実行 ASTサンドボックス脱出 認証前RCE in Crawl4AI.read を実行します。 コマンドの出力は JSON レスポンス内の インバンド で返されます。 | ---|--- CVE| CVE-2026-53753 Advisory| GHSA-qxjp-w3pj-48m7 影響を受けるバージョン| Crawl4AI 詳細な分析: ANALYSIS.md では、ノードごとの AST ウォークスルー、 ランタイムフレームスタック、リクエストデータフロー、パッチ差分を確認できます。 1. 根本原因...

CVE-2026-86157

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2026-48962

摘要 File::GlobMapper::getFiles 中存在一个 eval 注入漏洞，允许任何能够控制传递给 IO::Compress::Gzip::gzip、IO::Compress::Zip::zip 或任何同类函数的输出文件通配符参数的攻击者，在运行进程的上下文中执行任意 Perl 代码。无需认证。影响是全面的：主机进程的机密性、完整性和可用性完全受损。 详情 File::GlobMapper::parseOutputGlob 通过将调用者提供的输出模式包裹在 Perl 双引号中并将结果存储来构建输出文件名模板。然后 getFiles 将该字符串直接传递给...

CVE-2026-25057

CVE-2026-25057 MarkUs is a web application for grading student assignments. Summary MarkUs assignment configuration ZIP uploads are vulnerable to path traversal Zip Slip, allowing arbitrary file write and enabling remote code execution. Details Archive entry names are used to construct filesystem...

Malicious code in exptred (npm)

The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in express-javascript (npm)

The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in xeprews (npm)

The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17294 Malicious code in react-nodejs (npm)

The package react-nodejs impersonates the legitimate 'react' package it republishes react's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17247 Malicious code in exptredd (npm)

The package exptredd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17243 Malicious code in express-nodejs (npm)

The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in react-nodejs (npm)

The package react-nodejs impersonates the legitimate 'react' package it republishes react's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exptredd (npm)

The package exptredd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17242 Malicious code in express-javascript (npm)

The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17248 Malicious code in xeprews (npm)

The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...