Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

CVE-2025-30208-31125-31486-32395

Guida allo sfruttamento delle vulnerabilità di Vite CVE-2025-30208/31125/31486/32395 Questo documento riassume i metodi di sfruttamento di quattro vulnerabilità di lettura arbitraria di file nel server di sviluppo di Vite, inclusi esempi per sistemi Linux e Windows. Nota: utilizzare solo in...

threat-finder

OffSeq Threat Finder threat-finder findet die verwundbare Software, die tatsächlich auf einem Host läuft – nicht das, was ein Manifest behauptet – und zeigt Ihnen, welche Ergebnisse netzwerkerreichbar sind. Es löst jeden laufenden Dienst und mit --scope all auch jedes installierte...

CVE-2026-23744-PoC

Beschreibung MCPJam Inspector ist die Local-First-Entwicklungsplattform für MCP-Server. Die Versionen 1.4.2 und früher sind anfällig für eine Schwachstelle zur Remote-Code-Ausführung RCE, die es einem Angreifer ermöglicht, eine manipulierte HTTP-Anfrage zu senden, die die Installation eines...

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2 Una vulnerabilità critica di RCE in MCPJam Inspector 3.Avvia l'exploit root@kitploit: python3 CVE-2026-23744.py -u -i -p 4.Per un utilizzo migliore consiglio di aggiornare il terminale a uno completamente funzionale, altrimenti non sarai in grado di...

cve-2026-23744

CVE-2026-23744 – MCPJam Inspector Execução Remota de Código RCE Não Autenticada Descrição Produto : MCPJam Inspector Versões afetadas : ≤ 1.4.2 Versão corrigida : 1.4.3 Tipo : Execução Remota de Código RCE Não Autenticada Vetor de ataque : Rede Autenticação necessária : Não Interação do usuário...

CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE Durante l'analisi di questa vulnerabilità, ho scoperto che MCPJam Inspector esponeva l'endpoint /api/mcp/connect alla rete associandosi a 0.0.0.0. Questo endpoint accetta un oggetto JSON contenente serverConfig, inclusi i campi command e args. L'applicazione avev...

CVE-2025-49844-discovery

ElastiCache Redis/Valkey Netzwerkanalyse-Tools Skripte zur Prüfung von AWS ElastiCache Redis- und Valkey-Clustern auf Netzwerkexposition. Voraussetzungen AWS CLI mit entsprechenden Anmeldeinformationen konfiguriert jq installiert: brew install jq Skripte list-elasticache-clusters.sh Listet alle...

EUVD-2026-66846

Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

PT-2026-82413

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0...

Binding to an Unrestricted IP Address

Overview Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address through the ForwardPorts path in pkg/cmd/codespace/ports.go. An attacker can reach a forwarded Codespaces service from other hosts on the victim’s network by having the user run gh codespace ports...

DEBIAN-CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-72924

GitHub CLI (gh) versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default, rather than restricting it to loopback. This exposes the forwarded Codespaces service through a wildcard-bound listener on the user's local ...

EUVD-2026-66116

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

openclaw-technical-analysis

Analisi Tecnica di OpenClaw Questo repository contiene le mie recensioni tecniche approfondite e audit del codice della piattaforma OpenClaw AI concentrandosi specificamente sulle build del 15 e 25 febbraio 2026. Queste recensioni si basano sull'analisi dell'architettura grezza, sulla cronologia...

CVE-2025-14847

📝 Scanner MongoDB – Notas de Execução Nome do Script mongoexposurescanner.py 1. Pré-requisitos Python 3.9+ Acesso de rede aos hosts alvo Escopo aprovado para varredura Verifique o Python: root@kitploit: python3 --version 2. Arquivos Utilizados Arquivo| Finalidade ---|--- mongoscanner.py| Script...

CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...