CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

EUVD-2026-87371

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-86066

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-63432

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-100382

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...

CVE-2026-100383

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

CVE-2026-100381

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-96795

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

EUVD-2026-87370

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

USBArmyKnife

🚀 USB Army Knife v2 正在酝酿中——它将是一头猛兽 在 v1 上进行了两年的积极开发之后，v2 计划将 USB Army Knife 打造成一个完整的口袋里的红队平台 。今年秋天将发布重大公告，但我还是想先透露一下： 全新的 Web UI ——更小巧、更快速、更精致且支持多语言，内置 VNC 查看器 ，可直接从浏览器观看并操控目标。它不会像现在这样绑定任何 Web 工具，因此任何人都可以对其进行修改。 全新的 UAK 脚本引擎 ——兼容 DuckyScript v3，但在完整字符串和返回码支持方面远超 DuckyScript 3 所能做到的一切。这使得编写更整洁、更健壮...

CGA-MWM6-6XW8-6697

Bulletin has no description...

CGA-RJ62-FQ2P-V882

Bulletin has no description...

CGA-45CV-3FQX-448P

Bulletin has no description...

CGA-Q7C6-76G4-GFCV

Bulletin has no description...

CGA-66XJ-CXPP-RF76

Bulletin has no description...

CGA-XFM6-5FXG-F4M2

Bulletin has no description...

prismor

Prismor Runtime security for Claude Code, Codex, Langchain and other AI agents frameworks/harness. Prismor is highly customizable based on user's own policies. Observe or enforce mode to see agent activity in a local self-serve dashboard Website • Onboard with Skill...

badPods

Bad Pods さまざまな昇格特権を持つポッドを作成するマニフェスト集です。hostNetwork、hostPID、hostPath、hostIPC、privileged などのセキュリティ上重要なポッド属性を許可した場合の影響をすばやく実証できます。 詳細な背景については、以下のブログ記事を参照してください: Bad Pods: Kubernetes Pod Privilege Escalation。 目次 Bad Pods のラインナップ 前提条件 リポジトリ構成 使用方法 ハイレベルな進め方 使用例 クローンしたローカルリポジトリから8つの Bad Pod をすべて作成する...