frida

frida This repository contains various Frida scripts for Android application penetration testing. I created this project to demonstrate the capabilities of the Frida dynamic-analysis framework. You can read my "Introduction to Frida" blog post on Medium, where I'm explaining how to use Frida with...

CVE-2026-86195

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

CVE-2026-82659

A flaw was found in nodemailer. Authenticated attackers can bypass security flags by crafting raw messages with specific file paths or URLs. This allows them to read arbitrary files from the system or perform Server-Side Request Forgery SSRF, potentially leading to information disclosure or...

CVE-2026-82659

nodemailer before 9.0.1 contains a sandbox-bypass vulnerability in its message-level raw option. The disableFileAccess and disableUrlAccess flags are not applied when the raw option is used, allowing authenticated attackers to read arbitrary files or perform server-side request forgery (SSRF) by ...

CVE-2026-82659 nodemailer before 9.0.1 File Read and SSRF via raw option

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...

CVE-2026-78323

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...

CVE-2026-57826

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored...

CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

CVE-2026-47767 Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

CVE-2026-56274

Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions f...

PT-2026-41137

Name of the Vulnerable Software and Affected Versions wger version 2.5.0a2 Description A logical error in the permission check allows an authenticated gym trainer to escalate privileges to a gym manager or general manager account. By chaining two calls to the trainer-login endpoint, a trainer can...

CVE-2026-39418 MaxKB: SSRF via sandbox network hook bypass

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypassed by using socket.sendto with the MSGFASTOPEN flag. This allows authenticated user with tool-editing permissions to reach internal services that are explicitly blocked by the...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2026-1442)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1442 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks...

Important: runc

Issue Overview: cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Affected Packages: runc Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to...

CVE-2019-20870

An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID...

MAL-2025-188437 Malicious code in ophiuchus-callisto-semantic-ui-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d65af75f6acff48d55a94e31741a5da41d9e26f8b607169d254ab4d96271cb5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138348 Malicious code in yuni-gepuk62-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d3c1471b8cb2d019f0999d9670a1996c10891f291dde408f050b5a62ff7eeac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kurniawan-serimuka53-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53cefd0a0194a3acff1238ccee1f8ad737da6592244f9c8e370641d1174b0368 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-86124 Malicious code in hadi-gulai35-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9819ab3ca2bc12b78c7f8865dc00f0bbb67098e00e21e7a5120c837fdca4a14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-keraktelor20-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56c3b64280c053d4b4ed3bdb0424c39d01143276f9e68402d3dc165367e2c300 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...