CVE-2026-23005-Matter-Commissioning-Code-Brute-Force-Without-Rate-Limit

CVE-2026-23005 – 속도 제한이 없는 Matter 커미셔닝 코드 무차별 대입 프로그램 코드Python Matter 시뮬레이션 mattercommissioningsim.py import random realcode = random.randint10000000, 99999999 def attemptjoincodeattempt: Simulate joining: no delay, no lockout if codeattempt == realcode: print"Joined successfully!" return True...

CVE-2021-23639

개요 md-to-pdf는 Markdown 파일을 PDF로 변환하는 CLI 도구입니다. 이 패키지의 영향을 받는 버전은 JS 엔진을 비활성화하지 않고 front matter 콘텐츠를 파싱하기 위해 gray-matter 라이브러리를 사용하므로 원격 코드 실행RCE에 취약합니다. 사용법: python3 cve-2021-23639.py targerurl command 더 보기 md-to-pdf의 원격 코드 실행RCE...

CVE-2026-78847

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

CVE-2026-78806

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component...

CVE-2026-78847

All versions of gray-matter (verified on version 4.0.3 ) are vulnerable to arbitrary code execution. The flaw exists in the JavaScript engine located in lib/engines.js , where the application uses eval() to parse front matter when the language is set to js/javascript . While the documents do not ...

CVE-2026-78806

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component...

CVE-2026-78806: Exposure of Sensitive Information to an Unauthorized Actor

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component...

PT-2026-96303

Name of the Vulnerable Software and Affected Versions Matter Project Chip version 1.5.1 Description An implementation gap in the Matter Standard Specification allows a local attacker to obtain sensitive information. This occurs through the PerformCommissioningStep function within the...

CVE-2026-78806

An issue in the Matter Standard Specification-Implementation gap v1.5.1 (Matter Project Chip V1.5.1) allows a local attacker to obtain sensitive information . The vulnerability exists within the PerformCommissioningStep function in the ChipDeviceController.cpp component. No specific exploit detai...

CVE-2026-78847

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

CVE-2026-78847

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

PT-2026-96304

Name of the Vulnerable Software and Affected Versions gray-matter affected versions not specified Description An issue in the JavaScript engine located in lib/engines.js uses the eval function to parse front matter when the language is set to js/javascript, which can lead to arbitrary code...

CVE-2026-78806

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component...

CVE-2026-78847: Improper Neutralization of Directives in Dynamically Evaluated Code

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

CVE-2026-74234

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-74234

...

EUVD-2026-60437

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-74234

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-74234

...

CVE-2026-74234

Legora before 2026-08-14 contains a cross-site scripting (XSS) vulnerability. The root cause is that a Mermaid block prefixed with a gray-matter JavaScript front-matter directive causes the front-matter parser to invoke eval() before any SVG sanitization occurs, enabling arbitrary JavaScript exec...