EUVD-2026-92866

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-55726

CVE-2026-55726: 公開リスト可能なAzure Blob Storageコンテナ（デバイスログ） アドバイザリ フィールド| 値 ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 中 Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE| CWE-497...

lighthouse

Lighthouse - A Coverage Explorer for Reverse Engineers Overview Lighthouse is a powerful code coverage explorer for IDA Pro and Binary Ninja, providing software researchers with uniquely interactive controls to study execution maps for native applications without requiring symbols or source. This...

Hscan

Hscan-Win-Gui HScan v1.20 사용 설명 1. 시스템 요구 사항: Windows NT/2000/XP 2. 소프트웨어 소개: 다중 스레드 방식으로 지정된 IP 대역지정 호스트 또는 호스트 목록을 검사합니다. GUI 및 명령줄 두 가지 방식. 검사 항목: -name --- 호스트 이름 획득; -port --- 기본 포트 스캔; -ftp --- FTP 배너, 익명 사용자, 약한 암호 계정 스캔; -ssh --- SSH 배너 스캔; -telnet --- TELNET 배너, 약한 암호 계정 스캔; -smtp ---...

CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...

Security Bulletin: Due to the use of Java SE, IBM Sterling Control Center is vulnerable to multiple CVEs (CVE-2026-70906, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589, CVE-2026-16440)

Summary Java SE is used by IBM Sterling Control Center as part of dependency in IBM Semeru Runtime CSPU - Aug 2026 - Includes OpenJDK August 2026 CPU. Vulnerability Details CVEID:CVE-2026-70906 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via...

CVE-2026-105648

The Ghost Node.js content management system is vulnerable to a validation issue in versions 6.0.9 through 6.65.0 . An unauthenticated user can abuse certain functionalities, such as Webmentions , to perform limited HTTP requests to hosts within the server's internal network on specific network co...

CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105647 Ghost: Server-Side Request Forgery in Bookmark Fetching

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

CVE-2026-105647 Ghost: Server-Side Request Forgery in Bookmark Fetching

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

CVE-2026-105647 Ghost: Server-Side Request Forgery in Bookmark Fetching

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

CVE-2026-90077

A flaw was found in the Linux kernel's network net subsystem. An issue in the copynetns error handling path allows for resources allocated during network namespace creation to leak. This occurs because the preinitnet function returns prematurely, preventing proper resource deallocation. A local...

CVE-2026-33234

AutoGPTのメール機能を内部ネットワークスキャナーに変えた方法 CVE-2026-33234 | 中程度 5.0 | GHSA-4jwj-6mg5-wrwf 著者: Pavan Nallamothu 私はAutoGPT...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

CVE-2021-44228

CVE-2021-44228 CVE-2021-44228 대량 탐지 도구 Python 3.9에서 작동하도록 Crypto 라이브러리를 수정해야 함 sudo vim /usr/local/lib/python3.9/dist-packages/Crypto/Random/UserFriendlyRNG.py 77행 교체 : t = time.clock 다음으로 교체 : t = time.perfcounter 사용 방법 : sudo python3 192.168.0.0/8 mylog.txt...

CVE-2026-23744

CVE-2026-23744 MCPJam inspector 원격 코드 실행: 개념 증명POC 사용법: python3 cve-2026-23744.py --target https:// --att-ip --att-p...

Urgent11-Suricata-LUA-scripts

Urgent11-Suricata-LUA-scripts CVE-2019-12255, CVE-2019-12256, CVE-2019-12258, CVE-2019-12260을 탐지하는 Suricata LUA 스크립트 CVE-2019-12255 이 스크립트는 CVE-2019-12255를 확인합니다. 검사되는 패킷은 PSH, ACK, URG 플래그가 설정되어 있어야 하며, 페이로드 크기가 1500바이트를 초과해야 합니다. 그런 다음 긴급 포인터urgent pointer 값이 0으로 설정되어 있는지 확인합니다. 이는 취약한 장치에서 정수...

Network-Filesystem-Forensics

네트워크 및 파일시스템 포렌식 취약한 wu-ftpd CVE-2001-0550를 악용하는 허니팟에서의 포스트 익스플로잇post-exploitation 보고서...

NetScope

NetScope Windows向けオフラインファーストのネットワーク調査・対応プラットフォーム。 NetScopeは、セキュリティアナリスト、インシデントレスポンダー、CTFプレイヤーのための デスクトップアプリケーションです。パケットキャプチャ.pcap / .pcapngまたは ライブインターフェースを取り込み、完全な証拠に基づく調査結果 — 判定、攻撃ストーリー、 侵害指標IoC、抽出した戦利品loot、ワンクリック対応アクション — に変換します。 クラウドサービスも有料APIも使わず、すべてお使いのマシン上で完結します。 NetScopeを選ぶ理由...