mcp-pwn

CVE-2026-23744 — Exécution de code à distance non authentifiée MCPJam Résumé MCPJam est un inspecteur et proxy MCP Model Context Protocol open-source utilisé pour connecter, déboguer et gérer des serveurs MCP. Les versions = 1.4.3 Vecteur d'attaque| Réseau — Aucune authentification requise...

cve-2026-85706-poc-exploit-gitlab

cve-2026-85706 Неаутентифицированное произвольное чтение локальных файлов в GitLab CE/EE. Затрагивает 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1. Исправлено в 19.1.8 / 19.2.6 / 19.3.2 2026-09-10. CVSS 10.0, по сообщениям эксплуатируется в дикой природе. Оригинальный отчёт от s3ntago, а этот...

CVE-2026-101043: Insertion of Sensitive Information Into Sent Data

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2025-64513

CVE-2025-64513 – Preuve de concept de contournement d'authentification du proxy Milvus 📘 Aperçu Ce dépôt contient un script de preuve de concept PoC pour vérifier l'existence de CVE-2025-64513 , une vulnérabilité critique de contournement d'authentification dans Milvus Proxy qui pourrait permettr...

CVE-2025-30208_POC

Scan sans proxy python3 poc.py -f urls.txt Scan avec proxy python3 poc.py -f urls.txt --proxy http://127.0.0.1:8080...

trustmebro

Bypass llm guardrails by confusing it with fabricated tool output. Results · Installation · Quick start · Rules · Architecture TrustMeBro intercepts command-line tools invoked by coding agents such as Codex, Claude Code, and pi. Rules decide whether to return fabricated output, modify the real...

CVE-2026-43499

CVE-2026-43499 — Use-After-Free в futex PI ядра Linux Ошибка removewaiter в kernel/locking/rtmutex.c используется путями быстрого захвата блокировки slowlock, а также для отката proxy-блокировки в rtmutexstartproxylock при вызове из futexrequeue. В случае proxy-блокировки waiter::task не является...

CVE-2024-2054

CVE-2024-2054 Application web administrative Artica-Proxy - désérialisation non sécurisée RCE Une preuve de concept d'exploitation pour l'application web administrative ARTICA PROXY CVE-2024-2054 Article de blog Plus de détails ici :...

test-cve-2025-29927

Тестовое приложение для эксплуатации CVE-2025-29927 Приложение NextJS использует аутентификацию на основе cookie и middleware для предотвращения несанкционированного доступа к странице /admin. Для запуска приложения выполните: yarn затем yarn dev Для получения несанкционированного доступа к...

CVE-2026-100676

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

CVE-2026-100624

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uploadexpiresat timestamp one hour and a 'pending' status are stored in buildrequests, but the upload proxy loads only appid...

CVE-2026-100625

Capgo capgo.app exposes a native build TUS upload proxy supabase/functions/backend/public/build/upload.ts that authorizes a caller against a single build job identified by the supplied builderjobid and validates only that job's stored uploadpath, but then forwards the user-controlled TUS resource...

UBUNTU-CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

LeitWacht

GitLab Runner Leitwacht Contrôle du trafic sortant réseau pour les conteneurs CI/CD de GitLab Runner. Leitwacht empêche les attaques de la chaîne d'approvisionnement en exfiltrant des secrets en contrôlant ce à quoi chaque conteneur de tâche peut accéder sur le réseau. Comment ça marche Leitwacht...

CVE-2026-100676

The media proxy/embed service of stoatchat (stoatchat/stoatchat) before version 0.15.5 contains a vulnerability where it improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml . An unauthenticated remote attacker can exploit this via the /prox...

CVE-2026-100676 stoatchat before 0.15.5 Local Filesystem Read via SVG

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

CVE-2026-100676 stoatchat before 0.15.5 Local Filesystem Read via SVG

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

EUVD-2026-87649

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

CVE-2026-100676 stoatchat before 0.15.5 Local Filesystem Read via SVG

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

EUVD-2026-87757

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...