Digital-Signature-Hijack

Digital Signature Hijack Hijacking legitimate digital signatures is a technique that can be used during red team assessments in order to sign PowerShell code and binaries. This could assist to bypass Device Guard restrictions and maintain stealthy in an engagement. DigitalSignatureHijack is a...

cve-2026-45033-class

Claude Code — git bare-repo / core.fsmonitor guard bypass PoC Proof-of-concept for the "malicious bare git repository →core.fsmonitor → code execution" vulnerability class cf. CVE-2026-45033 in GitHub Copilot CLI reproduced against Claude Code , defeating the extra bash permission guard Claude Co...

PYSEC-2026-4313 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...

GHSA-XPF3-P7GM-7756 BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...

EUVD-2026-42295

BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction...

CLEANSTART-2026-IP81999 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Security vulnerability affects the apache-nifi-registry package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

CLEANSTART-2026-JL35312 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Security vulnerability affects the rundeck package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

NPM: adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

NPM: adm-zip: getDataAsync bypasses the maxOutputLength size guard enforced by the synchronous getData path vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

EUVD-2026-64850

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...

CLEANSTART-2026-MN75797 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

PT-2026-108470

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

CVE-2026-100633

SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard util.IsForbiddenAbsPath, invoked from resolvePath is applied only to the allowed root of recursive operations and not to each resolved descendant path — an...

CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

EUVD-2026-87727

SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard util.IsForbiddenAbsPath, invoked from resolvePath is applied only to the allowed root of recursive operations and not to each resolved descendant path — an...

CVE-2026-100633

The SiYuan personal knowledge management system (versions 3.8.0 through 3.8.3 ) contains a sensitive-path guard bypass in the MCP file tool . The root cause is that the util.IsForbiddenAbsPath() check (invoked via resolvePath()) is only applied to the root of recursive operations rather than each...

EUVD-2026-86475

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636 Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636 Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636

The apache-airflow-providers-hashicorp component is vulnerable to a team-scope guard bypass in the HashiCorp Vault secrets backend . In multi-team deployments, a Dag author can provide a Variable key containing a path separator . This causes the backend to fall back to a team-agnostic path, allow...