CVE-2026-100381

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-96795

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

EUVD-2026-87370

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

USBArmyKnife

🚀 USB Army Knife v2 正在酝酿中——它将是一头猛兽 在 v1 上进行了两年的积极开发之后，v2 计划将 USB Army Knife 打造成一个完整的口袋里的红队平台 。今年秋天将发布重大公告，但我还是想先透露一下： 全新的 Web UI ——更小巧、更快速、更精致且支持多语言，内置 VNC 查看器 ，可直接从浏览器观看并操控目标。它不会像现在这样绑定任何 Web 工具，因此任何人都可以对其进行修改。 全新的 UAK 脚本引擎 ——兼容 DuckyScript v3，但在完整字符串和返回码支持方面远超 DuckyScript 3 所能做到的一切。这使得编写更整洁、更健壮...

CGA-MWM6-6XW8-6697

Bulletin has no description...

CGA-RJ62-FQ2P-V882

Bulletin has no description...

CGA-45CV-3FQX-448P

Bulletin has no description...

CGA-Q7C6-76G4-GFCV

Bulletin has no description...

CGA-66XJ-CXPP-RF76

Bulletin has no description...

CGA-XFM6-5FXG-F4M2

Bulletin has no description...

prismor

Prismor Runtime security for Claude Code, Codex, Langchain and other AI agents frameworks/harness. Prismor is highly customizable based on user's own policies. Observe or enforce mode to see agent activity in a local self-serve dashboard Website • Onboard with Skill...

badPods

Bad Pods さまざまな昇格特権を持つポッドを作成するマニフェスト集です。hostNetwork、hostPID、hostPath、hostIPC、privileged などのセキュリティ上重要なポッド属性を許可した場合の影響をすばやく実証できます。 詳細な背景については、以下のブログ記事を参照してください: Bad Pods: Kubernetes Pod Privilege Escalation。 目次 Bad Pods のラインナップ 前提条件 リポジトリ構成 使用方法 ハイレベルな進め方 使用例 クローンしたローカルリポジトリから8つの Bad Pod をすべて作成する...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

EUVD-2026-87369

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

threat-dragon

OWASP Threat Dragon OWASP Threat Dragon は、無料でオープンソースのクロスプラットフォームな脅威モデリングアプリケーションです。 脅威モデリングの図を作成し、図の要素に対する脅威を列挙するために使用されます。 Mike Goodwin は、脅威をモデリングするための直感的でアクセスしやすい方法を提供するオープンソースコミュニティプロジェクトとして Threat Dragon を創設しました。 Threat Dragon は、柔軟性とシンプルさを重視し、さまざまなタイプのチームが利用しやすいように設計されています。 このプロジェクトは OWASP...

area51

Every callback, captured. The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a dashboard you control, and it gets whatever response you choose in return. Getting started · Playbooks · CLI · Architecture ·...