Malicious Package

Overview seek-pass is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

polytracker

PolyTracker PolyTracker は、もともと Automated Lexical Annotation and Navigation of Parsers のために作られたツールであり、 The ALAN Parsers Project と呼ぶためだけに考案されたバックロニムです。しかし、現在ではプログラムのデータフロー解析と制御フロー解析を効率的に実行するための汎用ツールへと進化しました。PolyTracker は LLVM...

CVE-2025-5548

⚡ CVE-2025-5548: 취약점 연구 및 익스플로잇 이 저장소는 CVE-2025-5548 에 대한 기술적 분석과 개념 증명PoC 워크스루를 제공합니다. 이 연구는 초기 바이너리 검사부터 성공적인 익스플로잇까지 취약점의 전체 수명 주기를 다룹니다. ⚠️ 법적 및 윤리적 고지 이 저장소는교육 목적으로만 제공됩니다. 모든 연구는 통제되고 격리된 실험실 환경에서 수행되었습니다. 명시적 허가 없이 시스템에 이러한 기술을 무단 사용하는 것은 불법이며 비윤리적입니다. 🔍 취약점 개요 CVE-2025-5548 은 FreeFloat FTP...

CVE-2021-36934-export-shadow-volume-POC

CVE-2021–36934 파생된 해시는 PTH 및 bills 등의 위조에 사용됩니다. 여기서는 자세한 분석을 제공하지 않습니다. 또한, 대부분의 시스템 파일에 대한 접근 권한을 얻을 수 있다는 점을 고려할 때, 마이크로소프트 관계자들도 이를 권한 상승 취약점으로 분류한 바와 같이, 이 외에도 더 많은 공격 방법이 존재해야 합니다. 볼륨 섀도에서 파일을 내보내기 위해 간단한 스크립트가 사용되며, 단지 아이디어를 제공할 뿐입니다. 관리자 권한이 없다는 점을 감안할 때, 직접 작성하는 것이 더 쉽고, mimikatz보다 탐지를 피...

pigeon

Pigeon あなたのエージェントがサブエージェントを生成し、同じAPIキーを渡しました。そのサブエージェントは、本番環境へのデプロイ、支払いデータベースの読み取り、mainへのマージができるようになりました。 Pigeonはそれを阻止します。子エージェントにはPigeon Pass を渡します。これは、あなたができることのコピーではなく、実行が許可された内容に絞り込まれた署名付き認証情報です。 インストール Python 3.12以降。 git clone https://github.com/pigeonlabsHQ/pigeon.git cd pigeon pip install...

CVE-2026-100642

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

CVE-2026-96556 Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization

A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit h...

EUVD-2026-85635

A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit h...

CVE-2026-95819 anirbandutta9 College-Notes-Gallery login.php sql injection

A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...

CVE-2026-95819

A SQL injection vulnerability exists in the login.php file of anirbandutta9 College-Notes-Gallery (up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6). The root cause is the improper handling of the user/pass arguments, allowing for remote manipulation. The exploit has been disclosed to the pu...

PT-2026-97106

Name of the Vulnerable Software and Affected Versions anirbandutta9 College-Notes-Gallery versions up to 8c1cf3d98f30982d069c88ca172612c001eb39f6 Description A remote SQL injection exists in the login.php file. This issue occurs when the user and pass arguments are manipulated, allowing an attack...

CVE-2026-95819: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...

CVE-2026-63446 Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: A potential null-ptr-deref issue was fixed in passestablish. If getepfromtid fails to find a non-NULL value for ep, ep will be dereferenced later, regardless of whether it is empty. This patch adds a simple sanity che...

Astra Linux – Vulnerability in Apache2

Some modproxy configurations on the Apache HTTP Server versions 2.4.0 through 2.4.55 allow for an HTTP Request Smuggling attack. These configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch, where a non-specific pattern matches a portion of the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: calipso: fixed a memory leak in netlblcalipsoaddpass If IPv6 support is disabled at boot ipv6.disable=1, the calipsoinit - netlblcalipsoopsregister function is not called, and the netlblcalipsoopsget function always returns NULL...

Exploit for Heap-based Buffer Overflow in F5 Nginx_Gateway_Fabric

CVE-2026-42533 Lab — NGINX Two-Pass Capture Clobbering RCE...

CVE-2026-78560

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...