CVE-2026-23744

usage: exploit.py -h --lhost LHOST --lport LPORT --rhost RHOST CVE-2026-23744 - PoC options: -h, --help 이 도움말 메시지를 표시하고 종료합니다 --lhost, -l LHOST 공격자 IP 주소 --lport, -p LPORT 공격자 포트 --rhost, -t RHOST 대상 URL...

CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

Malicious code in gridster-coords (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245882b881fde3396fcb6e1e14f8b0014fc64cd1d02d27f101c8fd2a0b16c944 package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridster-coords instead of a...

Astra Linux – Vulnerability in python-git

All versions of the GitPython package are vulnerable to Remote Code Execution RCE due to improper user input validation. This allows for the injection of a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to...

UBUNTU-CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

CVE-2026-46581

CVE-2026-46581 affects Eclipse Mojarra 2.3 and later. The vulnerability lies in how the URL handing in DefaultFaceletFactory handles remote URLs, failing to sanitize or block them, allowing an attacker to specify a URL to a remote Facelet that can be included and processed with the server’s privi...

CVE-2026-54242 Statamic: Server-Side Request Forgery via Glide (DNS rebinding)

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly...

MAL-2026-10615 Malicious code in smb-common-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66072ca2fc20c19a01d0a2b888d90632a7d9bfdc34a2d1a71b61ad06975eae5c package.json declares a preinstall hook that runs index.js. On npm install, index.js collects host reconnaissance from the installer os.hostname,...

Malicious code in assertcoreutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e53b085bfe045b4aeabe9ad77e1066ab0883f27304197377681191c3118b780 assertcoreutils impersonates the popular chai assertion library: the README, the chai keyword, the lib/chai/ directory layout, and lib/chai.js are...

CVE-2026-49969

Vulnerability overview: Laravel-Mediable

CVE-2026-49969 Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource. Attackers can craft URLs targeting...

CVE-2026-49969 Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource. Attackers can craft URLs targeting...

MAL-2026-10444 Malicious code in markable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd358271f202636f12507f09da4e8f00c900ba46c9dca25a5a0526d35b75bf1d [email protected] declares scripts.preinstall = 'node index.d.js'. index.d.js base64-decodes an embedded payload and invokes it through an...

MAL-2026-10410 Malicious code in cookie-phase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17bfab347de8288575bca9677b9eb7652b0024cdbffc1efebe387378c243299c The package presents itself as the popular pino logger README badges, exported module.exports.pino = middleware but its name and metadata are...

MAL-2026-7022 Malicious code in tslint-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31b464b1646f8e2d36ce68a86af599cc49d5381f08af70302ff01f42957234a1 The package presents itself as the pino logger README, index.d.ts, docs/, and lib/ files all reference pinojs/pino but is published under the unrelat...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through improper authorization checks in the AddFile, EditFile, RemoveFile, and Edit handlers. An attacker can gain unauthorized access to read, modify, or delete files and project metadata across different...

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Summary Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding...