CVE-2026-23744-POC

CVE-2026-23744 — MCPJam Inspector 未认证远程代码执行 MCPJam Inspector -i -p -m Flag| 描述| 默认值 ---|---|--- -u| 目标 URL| 必填 -i| 你的监听 IP（LHOST）| 必填 -p| 你的监听端口（LPORT）| 必填 -m| 载荷方法：busybox、bash、python3| busybox 反弹 Shell 示例 步骤 1 — 启动你的监听器： nc -lvnp 4444 步骤 2 — 运行漏洞利用脚本： bash python3 POC.py -u http://127.0.0.1:627...

CVE-2026-105797

In SimpleChat versions 0.261.003 and 0.261.027 , an authorization ordering flaw in POST /api/user/plugins enables an authenticated low-privileged user to bypass security checks. By omitting the top-level MCP type , the _reject_non_admin_mcp_stdio inspection is skipped before the type is restored ...

mcpshield

mcpshield 一个针对未修补的 MCP STDIO 命令注入漏洞（CVE-2026-30623 系列，由 OX Security 于 2026 年 4 月披露，归为“设计问题”——无 SDK 补丁）的即插即用修复方案。只需导入一行代码，你的 Python 应用启动的每个 stdio MCP 服务器，在操作系统生成进程之前，其命令/参数/环境变量都会经过验证。 如果你是新手，请先阅读 适用范围，然后 安装 和 快速入门 将让你在两分钟内获得保护。 目录 项目状态 适用范围 安装 快速入门 选项 A：自动补丁（Python MCP 主机） 选项 B：静态检查（任何语言，零执行） 选项...

CVE-2022-22814_PoC

权限提升 - AsusSystemDiagnosis.exe - Proc39 完整路径: C:\WINDOWS\System32\DriverStore\FileRepository\asussci2.infamd64d385bdc0d33d66f9\ASUSSystemDiagnosis\AsusSystemDiagnosis.exe 问题: 由 AsusSystemDiagnosis.exe 暴露的 ALPC 端口 \RPC Control\ASHWTestServer 对所有用户完全可访问。通过此端口调用 RPC 的 Proc39 会在当前用户会话中生成一个以 SYSTEM...

CVE-2026-23744-PoC

CVE-2026-23744-PoC Descargo de responsabilidad: Esta prueba de concepto se proporciona exclusivamente para investigación de seguridad autorizada, fines educativos y entornos de laboratorio controlados p. ej., HTB, CTF o pruebas de penetración internas con consentimiento explícito por escrito. El...

CLEANSTART-2023-EI38317 "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak

Security vulnerability affects the chicken package. The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve call failed, resulting in a memory leak...

CLEANSTART-2023-NZ21733 "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve() call

Security vulnerability affects the chicken package. The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve call...

CVE-2026-79748 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

CVE-2026-79748

MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, contains a command injection vulnerability in the POST /api/servers and PUT /api/servers/:name endpoints prior to version 0.12.15. These endpoints spawn configured stdio processes via child_process.spawn but lack a...

PT-2026-83946

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

Malicious code in js-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500 On module load, src/api/session-api.js reads../../../../public/logo.ico a path outside the package, DES-decrypts the contents with the hardcoded key...

Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are...

MAL-2026-13658 Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

MAL-2026-13537 Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

Malicious code in supersig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f8e62aa65bb4fe5e96a52cf6c5ba83c2f1bcf47eca3027bf4daca071249e5 The published dist bundles dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js, reached via the package's main/module/browser entries on...

CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

MAL-2026-13397 Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

Malicious code in bigops-logs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a922558781f9614bc47976e2e695cc8a5996ef51865fb5b37928f842718b5d On require of bigops-logs-player, index.js loads polyfill.js, which reconstructs a list of Cloudflare Workers hostnames...

MAL-2026-13305 Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...