PT-2026-90005

🚨 CVE-2026-87910 When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the...

CVE-2025-55182

CVE-2025-55182 実際の説明をお探しの場合は、msanft/CVE-2025-55182 にわかりやすい説明（動作する PoC 付き）があります。 このリポジトリには、私が試した中で興味深い（ような）結果が得られたいくつかの試みが含まれているだけです。 ./thing.py に動作する PoC が含まれるようになりました。その大部分は https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3 から引用したものです。 古い内容 テンプレート: root@kitploit: !/usr/bin/env...

CVE-2021-41773

CVE-2021-41773 Apache HTTP服务器漏洞（仅影响2.4.49版本） 需求设置 httpd.conf root@kitploit: ... LoadModule cgimodule modules/modcgi.so 取消注释这一行 ... AllowOverride none Require all denied 注释掉这一行或设置为Require all granted ... 参考 https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis...

CVE-2023-4911

CVE-2023-4911-Looney-Tunables Looney Tunables 本地权限提升 CVE-2023-4911 演练（仅供教育用途） Links: IPPSEC 视频 Qualsys 博客文章 Qualsys 技术细节 漏洞利用 POC Python 脚本 GLIBC 源码 GLIBC tunables 文档 描述 什么是 ld.so？ 在计算机领域，动态链接器是操作系统的一部分，它在可执行文件执行时加载和链接 所需的共享库，通过将库的内容从持久存储复制到 RAM，填充跳转表并重定位指针。 例如，我们有一个程序使用 openssl 库来计算 md5 哈希： $ he...

auth v2.197.0

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

GHSA-F8G7-2XJC-7MFH rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

GHSA-3G9Q-V48F-HH9W Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

GHSA-4QPV-39HG-F7FX @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

CVE-2026-25513

CVE-2026-25513：FacturaScripts 在 API ORDER BY 子句中存在 SQL 注入漏洞 概述 字段| 详情 ---|--- CVE ID| CVE-2026-25513 严重等级| 高危 安全公告| 查看公告 发现者| Lukasz Rybak 受影响产品 facturascripts/facturascripts （版本：orderBy = $field . ' ' . $order; return $this; 该检查旨在允许 SQL 函数，但未能对其进行验证，从而允许任意 SQL 注入。 概念验证（PoC） 前提条件 有效的 API...

@argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

GHSA-4X45-GXVP-6283 @argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” 一个无需认证的远程代码执行漏洞，影响开源工作流自动化平台。 📖 目录 概述 技术细节 严重等级与 CVSS 受影响版本 影响 利用 检测 修复 临时措施 总结 🔎 概述 CVE-2026-21858 ，代号 “Ni8mare” ，是 n8n 中的一个严重漏洞。n8n 是一个用于构建自动化工作流（例如自动化 API 调用、集成、SaaS 连接器）的流行平台。 该漏洞允许未经认证的远程攻击者 与未正确验证的 webhook/表单端点交互，从而未经授权访问文件及内部服务器资源。 成功利用该漏洞可能导致完全远程代码执行（RCE）...

TS_LLMLib

tsllmlib - TrustedSec LLM 库 TrustedSec LLM 库 是一个用于与支持工具调用的本地大语言模型进行交互的 Python 库。通过利用本地 LLM 端点与 MCP（模型上下文协议）集成，它可以运行通常只有前沿模型才能实现的大规模工作流。 特性 本地 LLM 支持 ：连接任何兼容 OpenAI 的 API 端点，或使用本地 LLM 服务器 MCP 集成 ：完整支持 RPC 和 SSE 协议的模型上下文协议 工具注册表 ：内置文件操作工具，并支持扩展自定义工具 对话历史 ：在多轮对话中保持聊天上下文 时间限制 ：可配置的执行超时，防止操作失控 纯 Pytho...

gha-lab-ba8e0c4217

自动化研究产物 — 非上游项目。 本仓库是由自动化工具链构建的一次性实验环境，用于拉瓦尔大学（Université Laval）硕士论文中对已发表的 GitHub Actions 工作流漏洞的复现研究。它是 litestar-org/litestar 在提交 18d84d846b782ccaab06f550a4defce22b3082e8（2024-07-27）时的逐字快照，依据该项目自身的许可证重新分发，该许可证文件已原样包含在本快照中。 上游项目未 参与其中，也从未被作为攻击目标，此处研究的漏洞已是公开信息。本仓库中的每个密钥和变量均为随机生成的虚拟值——不包含任何真实凭据。Acti...

CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - 未認証の任意パスワードリセット CVE-2025-15030 User Profile Builder — 未認証のパスワードリセット → 管理者権限奪取 + シェルアップロード root@kitploit: / / \ |/ / / / / / \ / / / \ / \ | / | | //| \ / /| / | / /| \ | || | / | / || / | | | // | /\/ /| /|/ /\ |\| |\ || /| \ || /|...