CVE-2020-11651-poc

PoC exploit for CVE-2020-11651 and CVE-2020-11652 This is a proof of concept exploit based on the initial check script. Use it to verify you have successfully updated your Salt master servers to a release containing the required fixes. Thanks for F-Secure Labs for their research and reporting...

hush

Give your agents boundaries you can read. Get decisions you can verify. What · Quickstart · How it works · SDKs · CLI · Policies · Docs · Spec What is HushSpec? HushSpec is an open specification for the security controls an AI agent operates under. Write a policy in YAML, evaluate it in Rust,...

CVE-2026-86360

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This...

CVE-2026-86360

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This...

EUVD-2026-93778

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This...

CVE-2026-86360

Dell System Update , versions prior to 2.3.0.0 , is vulnerable to a path traversal flaw that allows unauthenticated remote attackers to gain filesystem access . This critical vulnerability can be leveraged to execute arbitrary code with root privileges , potentially leading to a complete compromi...

cve-2024-21626

CVE-2024-21626 Overview This repository contains code examples for an app vulnerable to CVE-2024-21626 as well as an eBPF gadget to detect exploitation attempts. This repoistory was created as part of this blog post. The gadget program used to detect this vulnerability is for demonstration purpos...

cve-2025-9074-poc

CVE-2025-9074 Educational PoC / Proof of Concept Code This repository contains a PoC for educational purposes that demonstrates the risk of exploiting Docker Engine's unauthenticated remote API to create a privileged container with read/write access to the host filesystem. The executable file is...

GHSA-J3HM-6RG5-MCHV vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...

NPM: vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

NPM: vm2: NodeVM require.external without an explicit require.root grants unrestricted host filesystem access and full RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

CVE-2026-78122-POC

CVE-2026-78122 — Proof of Concept Tecnativadocker-socket-proxy ≤ 0.5.0 — Insufficient Access-Control Granularity CWE-1220 CVSS 4.0: 8.3 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Attack Vector is Adjacent AV:A: the attacker needs local/adjacent network reach to the pro...

CVE-2020-11651-PoC

CVE-2020-11651-PoC Repository that contains a CVE-2020-11651 Exploit updated to work with the latest versions of python and handle the errors with the connections. README COPY FROM THE ORIGINAL REPOSITORY Original Repository PoC exploit for CVE-2020-11651 and CVE-2020-11652 This is a proof of...

CVE-2024-21626

CVE-2024-21626 Exploit Working Directory docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Important is to put -w /proc/self/fd/8\ Access the host filesystem using cat ../../../../../../../../../etc/passwd inside the container Exploit Symlink 1. docker run --name...

CVE-2025-32463

🚨 PoC: CVE-2025-32463 – Sudo chroot Escape Vulnerability A critical vulnerability affecting sudo versions 1.9.0 to 1.9.17p1 , allowing users to escape from chroot and gain access to the real root filesystem. 📌 Description CVE-2025-32463 is a local privilege escalation vulnerability in sudo that...

Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

EUVD-2026-81607

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1789979782)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789979782 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated...

Rocky Linux 10.2 [CIQ] Security Update: nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc Multiple Vulnerabilities (crlsa-2026_61377)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661377 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_61383)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661383 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via HTTP...