922365 matches found
CVE-2026-102794 Ziroom ZHOME A0101 ping command injection
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...
CVE-2026-102794
The Ziroom ZHOME A0101 1.0.1.0 is vulnerable to a command injection flaw due to improper processing of the url argument within the /api/ZRnetwork/ping file. This vulnerability allows for remote attack execution. While the exploit has been disclosed to the public and may be used, the vendor has no...
CVE-2023-45878
CVE-2023-45878 GibbonEdu Gibbon Exploit バージョン 25.0.1 GibbonEdu Gibbon バージョン 25.0.1 以前 GibbonEdu Gibbon バージョン 25.0.1 以前では、任意のファイル書き込みが可能です。 詳細情報 https://nvd.nist.gov/vuln/detail/CVE-2023-45878 https://herolab.usd.de/security-advisories/usd-2023-0025/ 免責事項...
nextjs-CVE-2025-55182
CVE-2025-55182 / CVE-2025-66478 React2Shell - Next.js リモートコード実行 RCE PoC Next.js Server Actions における深刻な脆弱性。React Flight Protocol のデシリアライズを介した認証不要のリモートコード実行が可能 概要 このリポジトリは、Server Actions（React Server Functions）を使用する Next.js アプリケーションに影響する深刻なRCE脆弱性の Proof of Concept PoC を含んでいます。 詳細| 情報 ---|--- CVE|...
CVE-2026-103040
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...
CVE-2026-102792
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...
CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...
CVE-2026-102793
A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in the set_time_zone function within the /api/ZRFirmware/set_time_zone file. An attacker can achieve remote command execution by manipulating the hostname/zonename argument. The documents indicate...
CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Summary CVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's...
GHSA-2GX3-RCP4-G85Q PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Summary CVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's...
MAL-2026-17296 Malicious code in test-agency-assignment-01 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2098eadf99f0ffe4dc04f478ed085034d30415cb52201be4f36f688298abc46e The tarball contains only package.json and an 8.4 MB Go-compiled Windows executable, Kelimasow.exe sha256...
Malicious code in test-agency-assignment-01 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2098eadf99f0ffe4dc04f478ed085034d30415cb52201be4f36f688298abc46e The tarball contains only package.json and an 8.4 MB Go-compiled Windows executable, Kelimasow.exe sha256...
Malicious code in test-agency-assign (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...
MAL-2026-17295 Malicious code in test-agency-assign (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...
Scannerweb
Scannerweb Python3 で書かれた脆弱性スキャナ。対象ウェブサイトのすべてのURLをファズし、それらをスキャンして scanner web を探します。 スクリーンショット /opt ディレクトリに移動（オプション） cd /opt/ このリポジトリをクローン git clone https://github.com/Khalidhusain786/Scannerweb.git scannerweb フォルダに移動 cd Scannerweb 依存関係のインストール sudo apt install python3-pip pip3 install -r...
CVE-2026-103040
LightLLM versions through 1.2.0 are vulnerable to remote code execution (RCE) within the router profiler service when the --enable_profiling flag is used. The root cause is the exposure of an unauthenticated RPyC server with pickle deserialization enabled. This allows an attacker to execute arbit...
CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...
CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...
CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...