InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assemblyは、Cobalt Strikeの従来のfork and run方式のexecute-assemblyモジュールの代替として、セキュリティ専門家がプロセス内で.NETアセンブリを実行できるようにする概念実証のBeacon Object File（BOF）です。InlineExecute-Assemblyは、エントリポイントが Mainstring args または Main の任意のアセンブリを実行します。これにより、ほとんどの公開ツールを事前の修正なしに実行できるはずです。...

TangledWinExec

Tangled WinExec 此仓库用于研究 Windows 进程执行技术。 大多数 PoC 都按与其对应的技术命名。 项目 BlockingDLL : 该工具集用于测试阻止 DLL 的进程。参见 README.md。 CloneProcess : 此目录用于进程分叉与反射。参见 README.md。 CommandLineSpoofing : 此 PoC 实现命令行欺骗（Command Line Spoofing）。该技术可能不适用于 Windows 11。 DarkLoadLibrary : 此目录中的 PoC 用于测试由 @batsec 发布的 Dark Load...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

sinter

Sinter Sinterは、macOS 10.15以降向けの100%ユーザーモードのエンドポイントセキュリティエージェントで、Swiftで記述されています。 Sinterは、ユーザーモードのEndpointSecurity APIを使用して、セキュリティ関連のイベントタイプセットについて、macOSカーネルからの認可コールバックを購読および受信します。現在のバージョンでは、プロセス実行の許可/拒否をサポートしています。将来のバージョンでは、ファイル、ソケット、カーネルイベントなどの他のタイプのイベントもサポートする予定です。 Sinterは開発中です。...

cve-2026-23744

CVE-2026-23744 – MCPJam Inspector 未认证远程代码执行（RCE） 描述 产品 ：MCPJam Inspector 受影响版本 ：≤ 1.4.2 修复版本 ：1.4.3 类型 ：未认证远程代码执行（RCE） 攻击向量 ：网络 是否需要认证 ：否 是否需要用户交互 ：否 CVSS v3.1 ：9.8（严重） CVE-2026-23744 是一个影响 MCPJam Inspector ≤ 1.4.2 的严重 未认证远程代码执行（RCE） 漏洞。问题在于 Inspector 暴露了一个管理端点（/api/mcp/connect），该端点接受用户可控的 MCP...

CVE-2023-32571

🐞 CVE-2023-32571 - System.Linq.Dynamic.Core 远程代码执行 用于 CVE-2023-32571 的概念验证，该漏洞是 System.Linq.Dynamic.Core（1.0.7.10 至 1.2.25）中的一个远程代码执行漏洞。当包括 Where、Select、OrderBy 在内的方法接收到未受信任的输入并被解析时，攻击者可利用该漏洞执行任意代码和命令。 ⚠️ 免责声明 本工具仅用于教育和授权测试目的 。未经双方事先同意而使用本工具攻击目标属于违法行为。开发者不承担任何责任，也不对因使用本程序造成的任何滥用或损害负责。 🎯 先决条件 .NET...

CVE-2026-100599

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...

EUVD-2026-87381

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...

CVE-2026-100599

OpenClaw versions 2026.5.1 through 2026.7.0 are vulnerable to Remote Code Execution because the googlemeet.chrome command fails to apply the configured exec approval path. The command accepts caller-supplied audio command arrays and executes them on a paired node, bypassing the standard system.ru...

CVE-2026-100587

Versions of OpenClaw prior to 2026.7.1 are vulnerable to an authorization bypass in the Codex computer-use installation command . The flaw occurs because the system fails to properly validate owner authorization, allowing non-owner channel senders to install arbitrary plugins and execute MCP proc...

CVE-2026-79919

MaxKB , an open-source enterprise AI assistant, has a sandbox-escape vulnerability in its function-library code prior to version 2.10.6-lts . Attackers can bypass the LD_PRELOAD sandbox by invoking ctypes.CDLL from an importlib.abc.MetaPathFinder callback—causing the dlopen call-stack heuristic t...

PT-2026-96264

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.6-lts Description Function-library code running under the LD PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback. This allows the dlopen call-stack heuristic to identify a Python...

Linux Distros Unpatched Vulnerability : CVE-2026-45794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource fall...

CVE-2026-45794

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

CVE-2026-45794

OpenAM Community Edition (through 16.0.6 ) is vulnerable to unsafe Java deserialization (CWE-502) in its Push Notification SNS callback resource (SnsMessageResource ). The route is mounted with anonymous access ; after a message ID expires from the in-memory dispatcher, it falls back to a CTS-sto...

CVE-2026-45794 OpenAM Unsafe Java Deserialization via SNS

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

CVE-2026-57124: Improper Neutralization of Special Elements used in an OS Command

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-76059

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by a protection mechanism failure (CWE-693) in its static code security scanner. An attacker who can submit custom component source code can bypass the scanner by crafting an annotated class-body assignment that resolves to a dangerous c...

PT-2026-89610

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A logic error in the static security scanner allows an attacker to bypass security checks by crafting an annotated class-body assignment. This technique uses alias tracking to resolve ...

CVE-2026-78574 Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...