76927 matches found
AZL-106806 CVE-2026-93320 affecting package moby-engine 25.0.3-20
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...
CVE-2026-93320
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...
smt878u-ionstack-poc
smt878u-ionstack-poc !CAUTION THIS PROJECT IS UNFINISHED — IT DOES NOT WORK YET. There is no working root on any device as of 2026-10-03. Do not expect the quick-start below to succeed. Read Current status before building or running anything. !WARNING STATUS: WORK IN PROGRESS / BLOCKED Not...
CVE-2026-93320
BuildKit is vulnerable to a flaw where it may be tricked into performing file actions using special file inodes instead of the expected regular files. This behavior can lead to blocked operations or, in environments with rootful workers , potentially allow unintended host device access . No speci...
CVE-2026-93320 BuildKit improperly handles special files in build snapshots
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...
EUVD-2026-92539
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...
CVE-2026-93320 BuildKit improperly handles special files in build snapshots
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...
CVE-2026-93320 BuildKit improperly handles special files in build snapshots
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...
CVE-2026-104976 Plane: SSRF in Gitea OAuth
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...
CVE-2026-59786
A flaw was found in Zabbix. A remote, unauthenticated attacker with network access to the trapper port can spoof host availability, compromising the integrity of monitoring data. The Zabbix server and proxy accept active agent heartbeat messages without verifying configured pre-shared key PSK or...
CVE-2026-59785
A flaw was found in Zabbix. The host search functionality in the web frontend allows filtering against fields that are not displayed, including stored Intelligent Platform Management Interface IPMI and Pre-Shared Key PSK credentials. An authenticated attacker with read access can exploit this by...
Malicious code in css-nrmgzn-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami...
MAL-2026-17576 Malicious code in css-nrmgzn-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami...
Malicious code in css-kfvwax-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface...
MAL-2026-17575 Malicious code in css-kfvwax-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface...
MAL-2026-17574 Malicious code in css-gwqyid-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/i...
Malicious code in css-gwqyid-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/i...
Starlette Host Header Auth Bypass (CVE-2026-48710)
Exploits CVE-2026-48710 by sending a malformed Host header so request.url differs from the raw scope path, bypassing middleware and endpoint restrictions that rely on request.url validation. !/usr/bin/env python3 -- coding: utf-8 -- """Starlette Host header bypass CVE-2026-48710 — auth restrictio...
GitLab Commits API file.path LFI (CVE-2026-85706)
Exploits CVE-2026-85706 in self-managed GitLab CE/EE: unauthenticated multipart POST to /api/v4/projects/id/repository/commits with attacker-controlled file.path reads arbitrary host files outside Workhorse temp directories. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab unauthenticated...