Security Updates for Microsoft Word Products C2R (September 2026)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. CVE-2026-69671, CVE-2026-69764, CVE-2026-72972, CVE-2026-72973,...

Security Updates for Microsoft Office Products C2R (September 2026)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. CVE-2026-69285, CVE-2026-77898, CVE-2026-78505 - Heap-based buffer...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — 応答URLの未検証取得による SSRF／ローカルファイル読み取り（CVE-2026-13233） Untrusted upstream：プロバイダーが、応答に入っていたURLをそのまま開いた話。 Drupal OpenAI Provider （aiprovideropenai）・SSRF （CWE-918）・CVE-2026-13233 ・SA-CONTRIB-2026-053 状態 ：協調的開示は 完了（2026-07-10） 。Drupal Security Team へ非公開で報告 → 修正 → CVE-2026-13233 ／...

Weblate-CVE-2026-24126

Weblate — 通过 SSH 主机参数注入实现任意文件读取 发现者： Alejandro Baño · 2026年1月 致谢： Weblate 5.16 发布说明 概述 Weblate 的 SSH 主机密钥管理端点会将经过身份验证的管理员提供的 host 参数直接传递给ssh-keyscan，且不进行任何清理或参数验证。由于 ssh-keyscan 接受 -f 标志来从文件中读取目标主机名，因此拥有管理员凭据的攻击者可以将该标志作为主机值注入，从而强制服务器打开任意本地文件。由此产生的错误输出（或标准输出）会原样反映到浏览器中的错误消息块内，从而泄露文件内容。 漏洞详情 字段| 值...

CVE-2026-87997

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-15913

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

Ni8mare

🔒 Ni8mare Scanner 针对 CVE-2026-21858（Ni8mare 漏洞）的道德安全扫描器 “知识就是力量，但只有负责任地分享才有效。” 针对 n8n 工作流自动化实例的全面漏洞检测工具。可检测严重的 CVE-2026-21858 漏洞（CVSS 10.0），且不执行任何利用操作。 ⚡ 快速开始 root@kitploit: 进入脚本目录 cd ni8mare-scanner/scripts 安装依赖 pip install -r requirements.txt 检查某个版本是否存在漏洞 python n8nscanner.py version-check...

CVE-2026-15913

Fortra's GoAnywhere MFT versions prior to 7.10.2 are affected by a path traversal vulnerability in the /attachRemoteFiles endpoint. An authenticated Web User holding both Secure Folders and Secure Mail permissions can escape their sandboxed home directory, enabling arbitrary file read . The CNA-a...

CVE-2026-15913 Path Traversal in Fortra's GoAnywhere MFT Endpoint

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

DEBIAN-CVE-2026-79515

An out-of-bounds read in the stbttGetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted TTF file...

CVE-2026-79516

An out-of-bounds read in the stbspvsnprintf function stbsprintf.h of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted input...

CVE-2026-79522

An out-of-bounds read in the gfdmgetchunkdata function src/utils/downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

CVE-2026-79514

An out-of-bounds read in the gfdmdatareceived function downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

CVE-2026-79515

An out-of-bounds read in the stbttGetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted TTF file...

GHSA-M4F3-G4CQ-HQRX vulnerabilities

Vulnerabilities for packages: checkov, mlflow...

miniupnpd_poc

Miniupnpd path が526バイトを超えるコールバックURIを含む SUBSCRIBE リクエストを送信することで引き起こされます。 根本原因は、snprintf の戻り値を検証していないことです。snprintf は実際にコピーしたバイト数ではなく、コピー できたであろう バイト数を返すためです。 2019年1月25日時点で、このリポジトリ内のPoCはGoogle Wifiに対して正常にテストされています。 miniupnpd を利用する他のデバイスも影響を受ける可能性があります。 根本原因 upnpevents.c root@kitploit: static void...

qu1ckr00t

qu1ckr00t Androidカーネルの任意R/W（arbitrary R/W）の威力を示すPoCアプリケーションです（CVE-2019-2215）。解説: https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00tはPROOF OF CONCEPT（概念実証）です。貴重なユーザーデータが入った個人のデバイスで使用しないでください。動作確認はPixel...

CVE-2026-35584

CVE-2026-35584 POC - CVE-2026-35584 FreeScout 描述 摘要 端点 GET /thread/read/conversationid/threadid 不需要身份验证，并且不验证给定的 threadid 是否属于给定的 conversationid。这允许任何未经身份验证的攻击者： 通过传递任意 ID 将任何线程标记为已读 通过 HTTP 响应代码（200 与 404）枚举有效的线程 ID 跨会话操纵 openedat 时间戳（IDOR） root@kitploit: 受影响版本 1.8.211（最新版） 复现步骤 创建两个会话（convid=1 ...

CVE-2026-87911

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

DEBIAN-CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...