CVE-2026-100526 Vulnerability in discord

OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...

CVE-2026-100526

The @openclaw/discord npm package (OpenClaw's Discord integration) before version 2026.9.3 contains a vulnerability where it may fail to enforce sender-scoped media policies during emoji and sticker upload actions. An attacker permitted to invoke these actions could cause the application to read ...

Apache Druid - Local File Inclusion

Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t...

cve-2020-1054

CVE-2020-1054 CVE-2020-1054 LPE for Windows 7x64 Usage Install Rust if you need it https://www.rust-lang.org/learn/get-started Compile the code: cargo build --release Copy the .exe from target/release/ to target and execute. Windows KB If a specific Windows KB is not installed slight changes to t...

CVE-2024-30804

ASUS Driver LPE PoC Abuso de Memoria Física Este es un PoC para Local Privilege Escalation LPE que explota el driver AsInsHelp64.sys. Abusa de un driver legítimo y firmado de ASUS para mapear memoria física y sobrescribir tokens del kernel, obteniendo finalmente privilegios NT AUTHORITY\SYSTEM. 🎯...

EUVD-2025-26607

Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack requires a Prompt Injection in order to trick the agent to create malicious code...

CVE-2026-100526: Missing Authorization

OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...

openSUSE 16 Security Update : kbd (openSUSE-SU-2026:21939-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21939-1 advisory. This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that...

openSUSE 16 Security Update : haveged (openSUSE-SU-2026:21958-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21958-1 advisory. Changes in haveged: - CVE-2026-41054: Fixed local privilege escalation via the haveged command socket bsc1264086. Tenable has extracted the preceding...

CVE-2026-100547: Incorrect Behavior Order: Validate Before Canonicalize

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-68138

CVE-2026-68138: condición de carrera en la tabla de tasas qdisc de Linux para escalar a root local Este repositorio contiene un exploit de prueba de concepto de escalada local de privilegios para CVE-2026-68138 , una condición de carrera en el código de la tabla de tasas del control de tráfico de...

CVE-2026-66804-CrossDevice-LPE

CVE-2026-66804: Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability Proof of concept for a CrossDevice/FrameServer LPE I reported to MSRC which received CVE-2026-66804. It affects Windows 10 and Windows 11. Vulnerability Windows registers this machine-wide COM server:...

SUSE CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

RasmanPotato

RasmanPotato Gracias a @Wh04m1001 por la comunicación continua a lo largo del tiempo Otra potato más como las demás, utilizando el servicio RasMan para la escalada de privilegios Para Windows 10 11 no probado, Windows Server 2012 - 2019 2022 no probado Uso magicRasMan v0.1 Provided that the curre...

CVE-2022-29582-Exploit

CVE-2022-29582 This repository contains exploit code for CVE-2022-29582, a Local Privilege Escalation in iouring of the Linux kernel. Default configurations are affected and no special privileges should be needed. You can find the writeup at...

CVE-2026-23111-POC-noddlenpottato

CVE-2026-23111 — noddlenpottato nftables catchall UAF → LPE sin privilegios. de usuario a root en la mayoría de kernels linux 5.10—6.18. se auto-adapta al kernel objetivo — detecta offsets de structs, resuelve símbolos, encuentra gadgets ROP, determina la slab cache, genera un exploit a medida,...

CVE-2021-25253

Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE Date: 2023/05/04 Exploit Author: msd0pe Vendor Homepage: https://www.trendmicro.com My Github: https://github.com/msd0pe-1 Cliente de Trend Micro OfficeScan: Las versiones icacls "C:\Program Files x86\Trend Micro\OfficeScan Clien...

CVE-2024-1086

CVE-2024-1086 Con fines educativos. Referencias: https://pwning.tech/nftables/ https://github.com/Notselwyn/CVE-2024-1086 Kconfig: +CONFIGCONFIGFSFS=y +CONFIGSECURITYFS=y +CONFIGNFTABLES=y mnlcbrun: Operation not supported +CONFIGNETFILTERNETLINKGLUECT=y +CONFIGNETLINKDIAG=y +CONFIGNFTCT=y...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC y Reproducción Este repositorio contiene el código de explotación Proof-of-Concept PoC y la guía para reproducir la vulnerabilidad de Inclusión Local de Archivos LFI en MLflow, identificada como CVE-2023-1177. Información de la vulnerabilidad: ID de CVE: CVE-2023-1177...

cve-2026-31431

CVE-2026-31431 — Linux Kernel algifaead "Copy Fail": Analysis Security research on CVE-2026-31431 CVSS 3.1 7.8 HIGH , AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: three composable design flaws in the AFALG AEAD interface chain into a deterministic, race-free 4-byte page-cache write at any offset of any...