TokenUniverse

토큰 유니버스 토큰 유니버스 는 Windows 보안 메커니즘 을 실험 및 연구하기 위한 고급 도구입니다. 토큰 생성, 보기, 가장, 수정, 프로세스 생성, 로컬 보안 기관 관리, 다양한 객체의 접근 권한 확인 및 보안 수정 등을 위한 UI를 제공합니다. 이 프로그램은 LPAC AppContainer 샌드박스부터 SeTcbPrivilege 및 SeCreateTokenPrivilege 가 있는 SYSTEM까지 다양한 권한 수준에서 적어도 부분적으로 유용한 기능을 제공할 수 있습니다. 다운로드 이 도구는 Windows 7 이상을...

SpawnWith

SpawnWith spawnas 및 inject 명령의 대안을 제공하는 실험적인 Beacon Object FileBOF입니다. 이는 새로운 명령 spawnwith pid listener를 노출하며, 다음을 수행합니다: 1. 대상 프로세스에 대한 핸들을 얻습니다. 2. 프로세스의 기본 토큰에 대한 핸들을 얻습니다. 3. 기본 토큰을 가장 토큰으로 복제합니다. 4. Beacon의 spawnto 값을 가져옵니다. 5. CreateProcessWithTokenW를 사용하여 복제된 토큰으로 새 프로세스를 생성하려고 시도합니다. 이 시도...

CVE-2026-57124

PraisonAI (a multi-agent LLM framework) is vulnerable to unauthenticated remote code execution in versions prior to 4.6.59 . The default UI host applications expose POST /api/mcp/connect without mandatory authentication, accepting caller-controlled command and args fields that are passed to Stdio...

macnoise v0.5.0

MacNoise MacNoise generates real macOS telemetry: network connections, file writes, process spawns, plist mutations, TCC probes, and more. Point it at a machine running your EDR, SIEM, or firewall stack and see what actually fires - not what the vendor datasheet claims will fire. For background o...

CVE-2026-76227

Renovate versions 42.68.1 through 42.96.2 (and 42.68.1 through 43.4.3), along with corresponding Docker images, fail to restrict environment variables to an allowlist when spawning child processes. The root cause was an inadvertent removal of the filtering logic during a migration to the execa li...

MAL-2026-13738 Malicious code in @openzeppelin-5/contracts (npm)

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v5 line via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

CVE-2026-25856

OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that allows authenticated users to execute arbitrary C code on the server host by creating or modifying job configurations. Attackers can leverage the plain C execution mode, which lacks reference...

MAL-2026-4954 Malicious code in @cloudplatform-single-spa/observability (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

EUVD-2026-26093

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables...

Arbitrary Command Injection

cai-framework is vulnerable to Arbitrary Command Injection. The vulnerability is due to passing user-controlled input directly to shell commands via subprocess.Popen with shell=True, which allows an attacker to inject malicious arguments for example -exec in the findfile tool and execute arbitrar...

CVE-2025-61303

Hatching Triage Sandbox Windows 10 build 2004 2025-08-14 and Windows 10 LTSC 20212025-08-14 contains a vulnerability in its Windows behavioral analysis engine that allows a submitted malware sample to evade detection and cause denial-of-analysis. The vulnerability is triggered when a sample...

Exploit for CVE-2025-61303

CVE-2025-61303 - RecordedFuture Triage: Denial-Of-Analysis via...

SUSE-SU-2023:3899-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.3.0 ESR MFSA 2023-42, bsc1215575: Security fixes: - CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 bmo1846683. - CVE-2023-5169: Out-of-bounds write in PathOps bmo1846685. - CVE-2023-517...

Input validation

Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher level system privileges maintained by t...

SUSE CVE-2004-0807

Samba 3.0.6 and earlier allows remote attackers to cause a denial of service infinite loop and memory exhaustion via certain malformed requests that cause new processes to be spawned and enter an infinite loop...

SUSE CVE-2004-1058

Race condition in Linux kernel 2.6 allows local users to read the environment variables of another process that is still spawning via /proc/.../cmdline...

SUSE CVE-2014-8171

The memory resource controller aka memcg in the Linux kernel allows local users to cause a denial of service deadlock by spawning new processes within a memory-constrained cgroup...

async-http-proxy (>=1.2.1, <=1.2.3), barc-cli (>=2.2.0, <=2.2.1) +9 more potentially affected by CVE-2021-45710 via tokio (>=1.9.0, <=1.12.0)

tokio CARGO version =1.9.0, =1.2.1, =2.2.0, =0.73.0, =2.2.0, =0.2.8, =0.0.1, =0.12.0, =0.13.0 Source cves: CVE-2021-45710 Source advisory: OSV:GHSA-FG7R-2G4J-5CGR...

UBUNTU-CVE-2014-8171

The memory resource controller aka memcg in the Linux kernel allows local users to cause a denial of service deadlock by spawning new processes within a memory-constrained cgroup...

CVE-2016-7613

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context via a...