CVE-2025-59057-PoC

React Router の Framework Mode における meta/ API には、script:ld+json タグを生成する際に XSS 脆弱性が存在します。信頼されていないコンテンツを使用してタグを生成した場合、SSR 中に任意の JavaScript が実行される可能性があります。...

libprocesshider

libprocesshider ld プリローダーを使用して Linux 上でプロセスを隠蔽します。 完全なチュートリアルは https://sysdigcloud.com/hiding-linux-processes-for-fun-and-profit/ で入手できます。 手短に言うと、ライブラリをコンパイルします: gianluca@sid:/libprocesshider$ make gcc -Wall -fPIC -shared -o libprocesshider.so processhider.c -ldl gianluca@sid:/libprocesshider$ su...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker 任意ショートコード実行 検証ラボ CVE-2026-89274 を再現・検証するためのセキュリティリサーチ資料: WP Recipe Maker 自身が所有するシステム、または明示的にテストを許可されたシステムでのみ使用すること。 この PoC は、ラボで登録されたマーカーショートコードを含む評価コメントを 1 件投稿する。 破壊的なショートコードは使用せず、ディスクへの書き込みも行わない。 判定 ステータス: 提供されたラボで実証済み。 WP Recipe Maker 10.8.1 WordPress...

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

EUVD-2026-90685

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

Rocky Linux 10.1 [CIQ] Security Update: binutils / binutils-debuginfo / binutils-debugsource / etc (crlsa-2025_20155)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202520155 advisory. binutils: GNU Binutils ld elflink.c elfgcsweep memory corruption CVE-2025-5244 Tenable has extracted the preceding description block directly from the CIQ...

CentOS Linux 8 [TuxCare] Security Update: binutils / binutils-devel Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1776083558)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1776083558 advisory. - A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function...

CentOS Linux 7 [TuxCare] Security Update: binutils / binutils-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1777286373)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1777286373 advisory. - A flaw has been found in GNU Binutils 2.45. Impacted is the function bfdelfparseehframe of the file bfd/elf-eh-frame.c of the componen...

PT-2026-96263

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.6-lts Description The ToolExecutor LD PRELOAD sandbox fails to hook the fexecve function, although it hooks execve, execvpe, and execveat to prevent subprocess creation. An authenticated attacker with the ability t...

PT-2026-96264

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.6-lts Description Function-library code running under the LD PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback. This allows the dlopen call-stack heuristic to identify a Python...

Exploit for CVE-2026-89274

CVE-2026-89274 — WP Recipe Maker Arbitrary Shortcode Execution...

CVE-2026-9289

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2026-9289

WordLift – AI powered SEO – Schema plugin for WordPress (versions up to and including 3.54.10 ) is vulnerable to unauthenticated sensitive information exposure via its JSON-LD REST API endpoints (/wordlift/v1/jsonld/). The root cause is that these routes are registered with a permission_callback ...

CVE-2026-9289 WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

EUVD-2026-83565

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2026-9289 WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2026-9289: Exposure of Sensitive Information to an Unauthorized Actor

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

PT-2026-95743

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An issue allows unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on recipe page renders. This occurs because the WPRM Metadata::sanitize metadata...

PT-2026-95805

Name of the Vulnerable Software and Affected Versions WordLift – AI powered SEO – Schema plugin for WordPress versions prior to 3.54.11 Description Sensitive information exposure occurs via the JSON-LD REST API endpoints. The plugin registers the '/wordlift/v1/jsonld/' routes, specifically...