Learn-about-cve-2025-31133-poc

Learn-about-cve-2025-31133-poc Overview A proof-of-concept demonstration and learning environment for CVE-2025-31133 , a security vulnerability in runc that allows bypassing maskedPaths protection through a race condition. maskedPaths are designed to prevent containers from accessing sensitive ho...

POC-CVE-2018-0114

POC-CVE-2018-0114 이 저장소는 node-jose Stating from the last merge python lib: base64,urllib,rsa,sys 테스트 실행 스크립트를 실행하려면 다음 명령어를 실행하세요: python jwk-node-jose.py "payload" key-size key-size는 제외 작성자 Andrea Cappa - 초기 작업 - GitHub - Twitter Louis Nyffenegger - 지원 및 도움 - Louis - 추천인 ; 라이선스 이 프로젝트는 MIT...

CVE-2026-101905

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2024-23740

CVE-2024-23740 A An issue in Kap through 3.6.0 on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. There is a tool designed to automate the process of searching for vulnerabilities in electron:...

CVE-2018-0114

CVE-2018-0114 JWT 생성을 위한 python2.7 스크립트 CVE-2018-0114 Cisco node-jose 오픈 소스 라이브러리 0.11.0 이전 버전의 취약점으로, 인증되지 않은 원격 공격자가 토큰에 포함된 키를 사용하여 토큰을 다시 서명할 수 있습니다. 이 취약점은 node-jose가 JSON Web Tokens JWTs에 대한 JSON Web Signature JWS 표준을 따르기 때문에 발생합니다. 이 표준은 JWS의 헤더에 공개 키를 나타내는 JSON Web Key JWK가 포함될 수 있도록 지정합니...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905

The Axios HTTP client is vulnerable to a request socket hijack in versions 1.15.2 through 1.20.0 . The root cause lies in the Node HTTP adapter (lib/adapters/http.js), which fails to provide its own createConnection value. When combined with a separate same-process prototype-pollution flaw that p...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2025-65964-Exploit

Reproduction Steps First, prepare a repository containing a malicious file. mkdir n8n-rce-poc && cd n8n-rce-poc git init git remote add origin mkdir evilhooks echo '!/bin/sh' evilhooks/pre-commit echo 'touch /tmp/pwnedsuccess' evilhooks/pre-commit chmod +x evilhooks/pre-commit git add...

GO-2026-6520 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule...

CVE-2026-82936

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in...

CVE-2026-78424

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

EUVD-2026-88234

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in...

CVE-2026-82936 Denial of Service in mH-DEVELOPER

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in...

CVE-2026-82932 Missing Firewall Configuration in mH-DEVELOPER

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

ROOT-APP-NPM-CVE-2025-64718 CVE-2025-64718 in js-yaml - Patched by Root

Root has patched CVE-2025-64718 in the js-yaml package for Root:npm. Multiple fixed versions available...

EUVD-2026-88224

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2025-59528-PoC

CVE-2025-59528 PoC Flowise CustomMCP RCE 경로를 POST /api/v1/node-load-method/customMCP를 통해 트리거하는 Python PoC 스크립트입니다. ⚠️ 교육 및 공인된 보안 연구 목적으로만 사용하세요. 소유하지 않았거나 테스트를 위한 서면 허가가 없는 시스템에 이 도구를 실행하는 것은 불법입니다. 크레딧 im-soohyun Kim SooHyun 세부 정보 CVE-2025-59528에 대한 PoC 영향받는 버전: Flowise 3.0.5 패치 버전: Flowise 3.0....