850470 matches found
CVE-2021-43798
CVE-2021-43798 Grafana 8.x 路径遍历（未授权） 所有荣誉归 j0v 及其推文 https://twitter.com/j0v0x0/status/1466845212626542607 免责声明 仅供教育目的使用。本人不对你的行为负责。请自行斟酌使用。 本着善意，我已推迟发布此 PoC，直到该漏洞公开或补丁可用。 目录 解释 - 漏洞说明 攻击向量 - 可执行的攻击列表 利用脚本 - 利用脚本使用说明 解释 我注意到 j0v 的一条推文声称发现了 Grafana 路径遍历漏洞。出于好奇，我开始查看 Grafana...
poc-cve-2024-0132
poc-cve-2024-0132 复现环境： 操作系统：Ubuntu 22.04 搭配 NVIDIA 驱动 Docker：v27.1.0 nvidia-container-toolkit：v1.16.1 复现步骤： 运行 POC 容器镜像 目标： 在容器内访问主机文件 通过容器内的 docker.sock 调用 Docker 守护进程 API 复现 使用预构建的 POC 镜像 ssst0n3/poc-cve-2024-0132，或自行从源码构建。 root@kitploit: root@wanglei-gpu3: git clone...
CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
EUVD-2026-77598
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
CVE-2026-57124
PraisonAI (a multi-agent LLM framework) is vulnerable to unauthenticated remote code execution in versions prior to 4.6.59 . The default UI host applications expose POST /api/mcp/connect without mandatory authentication, accepting caller-controlled command and args fields that are passed to Stdio...
eaphammer
by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...
Zygotroller
Zygotroller Remove profile owners/Family Link on ANY pre June 2024 Developer Mode device Android 12+ Zygotroller is a proof-of-concept that can remove a profile owner and associated restrictions with CVE-2024-31317's Zygote injection bug. It requires developer mode and the latest security patch t...
sandfly-entropyscan
What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...
CVE-2024-3273
D-Link NAS 命令执行漏洞利用工具 该 Python 脚本利用 D-Link NAS 设备中的一个漏洞 CVE-2024-3273，允许执行任意命令。它利用该漏洞在受影响设备上远程执行命令。 功能 在 D-Link NAS 设备上执行任意命令。 支持单个主机以及从文件读取多个主机。 并发执行命令以提高效率。 可选择指定并发执行的线程数。 可选择指定要执行的自定义命令（默认为 id）。 输出彩色结果，便于识别易受攻击的主机及其响应。 环境要求 Python 3.10 Requests 库 2.26.0 Colorama 库 0.4.6 使用方法 python...
CVE-2025-5777-Exploit
Herramienta de Explotación CVE-2025-5777 🔥 Una herramienta educativa potente diseñada para demostrar y analizar la vulnerabilidad CVE-2025-5777 que afecta a Citrix NetScaler VPN. Este proyecto es parte de la iniciativa GO-TO CVE. ⚠️ Solo con fines educativos. NO lo uses en sistemas que no poseas o...
SUSE-SU-2026:4180-1 Security update for clamav
This update for clamav fixes the following issues: - CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records bsc1274598. - CVE-2026-20339: integer overflow in the PESpin...
Security update for clamav
This update for clamav fixes the following issues: CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records bsc1274598. CVE-2026-20339: integer overflow in the PESpin unpack...
Security update for clamav
This update for clamav fixes the following issues: CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records bsc1274598. CVE-2026-20339: integer overflow in the PESpin unpack...
SUSE-SU-2026:4179-1 Security update for clamav
This update for clamav fixes the following issues: - CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records bsc1274598. - CVE-2026-20339: integer overflow in the PESpin...
Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issues: Security issues fixed: CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128. CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass ...
SUSE-SU-2026:4178-1 Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issues: Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for...