Linux Distros Unpatched Vulnerability : CVE-2026-80919

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive wwmutex acquire in amdgpudevcoredumpformat When dumping IB conten...

GHSA-HXJG-93WC-H8P8 Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

GHSA-2R5Q-H53F-9RP3 @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

Important: Red Hat Security Advisory: ansible-core security update

An update for ansible-core is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2026-71807

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

exploit_playground

소개 여기에 공개 익스플로잇Public Exploit 분석이나 제 1day 익스플로잇 일부를 게시할 예정입니다. 공개 익스플로잇 분석 개인적으로 공개 익스플로잇을 배우는 가장 좋은 방법은 익스플로잇을 완전히 이해할 때까지 한 줄 한 줄 이해하는 것이라고 생각합니다. 저는 이러한 과도하게 주석이 달린 ; 익스플로잇 중 일부를 게시하여 다른 사람들도 배울 수 있기를 바라며, 커뮤니티에 조금이나마 환원하려는 시도를 합니다. 또한 문서화 목적도 있습니다. 이런 것들은 시간이 지나면 제 머릿속에서 희미해지기 때문입니다...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, helm-set-status, vitess, cluster-api-aws-controller, juicefs, verticadb-operator, kserve-rest-proxy, cluster-api-provider-vsphere, vcluster, conftest, secrets-store-csi-driver, gitsign, dynamic-localpv-provisioner, external-dns, rclone,...

CVE-2026-84445 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, helm-set-status, vitess, cluster-api-aws-controller, juicefs, verticadb-operator, kserve-rest-proxy, cluster-api-provider-vsphere, vcluster, conftest, secrets-store-csi-driver, gitsign, dynamic-localpv-provisioner, external-dns, rclone,...

Jammer-Loc

Jammer-Loc 이 저장소는 논문 “Machine and Deep Learning for Indoor UWB Jammer Localization.” 의 코드와 데이터셋 링크를 포함합니다. 사용 예시 하이퍼파라미터 최적화 과정 실행: root@kitploit: python hpo.py \ --task classification \ --mode actual \ --framework ml \ --config config.yaml \ --trials 50 \ --study-name mystudy 1. 모델과 지표는 main.py에...

CVE-2026-1312

CVE-2026-1312 は、危険度の高い Django SQL インジェクションの脆弱性です。QuerySet.orderby でドットを含む列エイリアスを使用し、FilteredRelation と組み合わせて辞書展開により動的にクエリを構築する際、攻撃者によって悪意のある SQL が注入される可能性があります。 影響を受けるバージョン: Django 6.0 ブランチの 6.0.2 より前のバージョン Django 5.2 ブランチの 5.2.11 より前のバージョン Django 4.2 ブランチの 4.2.28 より前のバージョン 環境の起動...

Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...

MAL-2026-16097 Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...

copy-fail-CVE-2026-31431-mitigation-ansible-playbook

CVE-2026-31431 완화 플레이북 Debian/Ubuntu 및 RHEL/Rocky/AlmaLinux 시스템에서 CVE-2026-31431 AFALG 커널 모듈 완화를 적용하고 롤백하는 Ansible 플레이북입니다. 개요 이 플레이북은 취약한 algifaead 커널 모듈을 비활성화하여 CVE-2026-31431을 완화합니다: Debian/Ubuntu 계열 : modprobe 블랙리스트 파일을 생성하고 모듈 언로드를 시도합니다 RHEL/Rocky/AlmaLinux 계열 9 & 10: grubby를 사용하여 커널 initca...

firmware-analysis-toolkit v2.0.0-alpha.1

FAT — Firmware Analysis Toolkit Firmware Analysis Toolkit is a security research toolkit for investigating firmware security for IoT, Physical AI, Mobile Devices & Robotics. It is primarily built for the "Offensive IoT Exploitation" training conducted by Attify. It has been built based on actual...

CVE-2016-5195

기록은 학습 목적으로만 사용하며, 불법적인 용도로 사용하는 것을 금지합니다 원리 이 취약점의 원리는 동시성Concurrency을 이용해 더티 페이지Dirty Page를 플러시Flush하여, 원래 읽기 전용 권한인 파일의 내용이 변경되도록 하는 것입니다 만약 수정된 파일이 root 소유이고 SUID 권한을 가지고 있다면, 이를 이용해 권한 상승Privilege Escalation을 수행할 수 있습니다 영향 범위 2016년 10월 이전에 컴파일되었고 버전이 2.6.22 4.8.3 사이인 커널, 2016년 10월 이후에는 대부분 패...

DEBIAN-CVE-2026-80919

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive wwmutex acquire in amdgpudevcoredumpformat When dumping IB contents from a hung job, amdgpudevcoredumpformat acquired the VM root PD's reservation via amdgpuvmlockbypasid and then, for each IB, called...

CVE-2026-80919

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive wwmutex acquire in amdgpudevcoredumpformat When dumping IB contents from a hung job, amdgpudevcoredumpformat acquired the VM root PD's reservation via amdgpuvmlockbypasid and then, for each IB, called...

AZL-99968 CVE-2026-80916 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PREEMPTRT syzbot is reporting KCOV state corruption on PREEMPTRT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CP...