CVE-2026-19274

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

EUVD-2026-71273

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2023-38831

CVE-2023-38831 - RARLAB WinRAR 代码执行漏洞 ⚠️ 仅供教育和授权安全研究使用 原始漏洞利用作者 非常感谢原始 PoC 作者 b1tg 和 Group-IB Threat Intelligence 描述 RARLabs WinRAR 6.23 之前的版本允许攻击者在用户尝试查看 ZIP 压缩包中的良性文件时执行任意代码。 问题成因在于：ZIP 压缩包可能包含一个良性文件（例如普通的 .JPG 文件），同时还有一个与该良性文件同名的文件夹；当用户仅尝试访问该良性文件时，文件夹中的内容（可能包含可执行内容）也会被处理。该漏洞已在 2023 年 4 月至 8...

CVE-2023-38831

CVE-2023-38831 这是一个易于使用的工具，用于创建影响所有6.23之前WinRAR版本的CVE-2023-38831漏洞利用程序。 关于CVE-2023-38831漏洞利用的更多信息 RARLAB WinRAR 6.23之前版本允许攻击者在用户尝试查看ZIP存档中的良性文件时执行任意代码。问题在于ZIP存档可能包含一个良性文件（例如普通的.JPG文件）以及一个与该良性文件同名的文件夹，并且在仅访问该良性文件的过程中，该文件夹的内容（可能包含可执行内容）会被处理。此漏洞于2023年4月至10月期间在野外被利用。 如何构建 要构建项目，只需在项目目录中运行此命令。...

CVE-2023-38831

CVE-2023-38831 概念验证（PoC） 这是一个易于使用的针对 CVE-2023-38831 的漏洞利用工具，该漏洞影响 WinRAR 6.23 之前的版本。 已发现 RARLabs WinRAR 6.23 之前版本存在可利用的漏洞。该漏洞使攻击者能够通过特制的 ZIP 存档执行任意代码。该漏洞源于对包含良性文件（如普通 .PDF 文档）以及与这些文件同名的文件夹的 ZIP 存档处理不当。当用户尝试访问该良性文件时，存档中可能包含一个同名文件夹，其中包含可执行内容。在尝试访问良性文件的过程中，该文件夹中的恶意内容会被处理，从而促成了任意代码的执行。该漏洞的利用已在 2023 年...

CVE-2023-38831

CVE-2023-38831 WinRAR RARLabs WinRAR 6.23 之前的版本存在漏洞，当用户尝试查看 ZIP 压缩包中的良性文件时，攻击者可执行任意代码。该问题源于 ZIP 压缩包可能包含一个良性文件（例如普通的 .JPG 文件），同时还包含一个与该良性文件同名的文件夹；在仅尝试访问良性文件时，该文件夹中的内容（可能包含可执行内容）也会被处理。该漏洞已在 2023 年 4 月至 8 月期间在野外被利用。 使用方法 用法： root@kitploit: - poc.py -h scriptPath benignPath zipDirectory fname 位置参数：...

CVE-2026-84672

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

CVE-2026-84672

The Jenkins Microsoft Entra ID (previously Azure AD) Plugin, versions 710.v0b_ff8e9cc2d2 and earlier , grants Entra group permissions based on both the group's unique object ID and its display name . An attacker who can create an Entra group with a colliding display name can thereby inherit the p...

CVE-2026-84672

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

EUVD-2026-70145

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

CVE-2026-84672

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

CVE-2023-38831-Exploit

Generador de Exploit CVE-2023-38831 para WinRAR Creado por: technicalcorp Este proyecto contiene un script en Python que explota CVE-2023-38831 , una vulnerabilidad en WinRAR versiones anteriores a la 6.23. El exploit genera un archivo RAR malicioso que desencadena la ejecución de código arbitrar...

Linux Distros Unpatched Vulnerability : CVE-2026-68513

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 an...

DEBIAN-CVE-2026-68513

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed...

CVE-2026-68513

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed...

CVE-2026-68514 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings contain a heap out-of-bounds write triggered when reading a crafted deep...

CVE-2026-68514

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings contain a heap out-of-bounds write triggered when reading a crafted deep...

CVE-2026-68514 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings contain a heap out-of-bounds write triggered when reading a crafted deep...

CVE-2026-68514

OpenEXR (the reference implementation for the EXR image format), versions 3.3.0–3.3.12 and 3.4.0–3.4.13 , contains a heap out-of-bounds write in its PyOpenEXR Python bindings. The trigger is a crafted deep scanline EXR file that declares a literal channel (e.g., left ) alongside layer-prefixed RG...

CVE-2026-68513

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed...