Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-84064 DESCRIPTION: IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affecting Tivoli Netcool/OMNIbus

Summary Vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus have been addressed. Vulnerability Details CVEID:CVE-2026-47057 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via...

GHSA-V2J5-22FR-J62R AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

Impact The fix for GHSA-vvp4-63h8-v5pm in 3.0.13 folded the authenticated principal into the HTTP/1.1 connection pool key, so that a connection one principal authenticated with NTLM, Kerberos or SPNEGO is not handed to another. It left three cases out. In each, a socket that one identity...

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

Impact The fix for GHSA-vvp4-63h8-v5pm in 3.0.13 folded the authenticated principal into the HTTP/1.1 connection pool key, so that a connection one principal authenticated with NTLM, Kerberos or SPNEGO is not handed to another. It left three cases out. In each, a socket that one identity...

GHSA-C44F-37QR-GW3F PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

Summary SkillTools.runskillscript accepts a scriptpath parameter and executes it via subprocess.run without any path containment validation. While FileTools has validatepath with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem...

PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

Summary SkillTools.runskillscript accepts a scriptpath parameter and executes it via subprocess.run without any path containment validation. While FileTools has validatepath with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem...

GHSA-4GFV-WG42-7JW5 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...

GHSA-4XXV-6WMF-XF45 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...

GHSA-QG25-6GC4-48MG PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Summary PraisonAI's webcrawl agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by issafecrawlurl, which resolves the hostname and rejects private/loopback/link-local IPs at validation time. The validated value is the URL string not a...

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Summary PraisonAI's webcrawl agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by issafecrawlurl, which resolves the hostname and rejects private/loopback/link-local IPs at validation time. The validated value is the URL string not a...

Exploit for Type Confusion in Apple Safari

WebKit / JSC Bug PoCs Proof-of-concept demonstrations for con...

Security Bulletin: IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility (CVE-2026-78404)

Summary IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility Vulnerability Details CVEID:CVE-2026-78404 DESCRIPTION: IBM Db2 is vulnerable to a local privilege escalation via the db2pd utility. CWE:CWE-269: Improper Privilege Management CVSS Source: IBM CVSS Base score: 6.5...

GHSA-MFJ3-87QQ-382V AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator. RFC 7616 section 3.3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext...

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator. RFC 7616 section 3.3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext...

BloodBash

BloodBash A SquidSec Open Source Project SquidOffense.com · GitHub BloodBash 는 SquidSec에서 만들고 관리하는 오픈 소스 오프라인 SharpHound 및 AzureHound JSON 분석기입니다. 그래프를 구축하고 AD/Entra 공격 경로와 잘못된 구성을 드러내며, 우선순위가 지정된 발견 사항을 출력합니다. Neo4j나 BloodHound UI가 필요하지 않습니다. | ---|--- Organization| SquidSec Website|...

CVE-2026-29000

CVE-2026-29000 — pac4j-jwt JWE 인증 우회 pac4j-jwt 라이브러리의 JWE 인증 취약점을 연구하는 CTF 랩 CVSS 9.3 Critical · CWE-287 · 영향: pac4j-jwt ← 관리자 패널 접근 ↓ 민감 데이터 읽기: 직원 목록, 시스템 설정, flag 프로젝트 구조 CVE-2026-29000/ ├── lab/ 대상 — Flask 앱 NexusBank Employee Portal │ ├── app.py 취약점이 있는 메인 애플리케이션 │ ├── Dockerfile 빌드 시...

CVE-2026-34486-poc

CVE-2026-34486 Apache Tomcat EncryptInterceptor 우회 취약점 재현 1. 취약점 개요 속성| 상세 ---|--- CVE 번호| CVE-2026-34486 심각도| Important / High（CVSS 3.1: 7.5） 취약점 유형| CWE-311 민감 데이터 암호화 누락 / CWE-807 신뢰할 수 없는 입력 제약 영향받는 버전| Apache Tomcat 9.0.116 / 10.1.53 / 11.0.20 수정 버전| Apache Tomcat 9.0.117 / 10.1.54 / 11.0.21...

CVE-2026-29000

CVE-2026-29000 익스플로잇 생성기 Rust 이 저장소는 pac4j-jwt의 인증 우회 취약점인 CVE-2026-29000을 악용하기 위한 전문 Rust 구현체를 포함합니다. 이 취약점은 암호화된 JWE 컨테이너 내부에 PlainJWTalg: none가 중첩되어 있을 때 "서명 검증 건너뛰기"에서 발생합니다. 기능 자동 JWKS 검색: 대상의 공개 RSA 키를 /api/auth/jwks 엔드포인트에서 직접 가져옵니다. 비보안 JWS 구성: 관리자 권한ROLEADMIN을 포함한 None 알고리즘 JWT를 생성합니다. J...