EUVD-2026-75208

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

PT-2026-89569

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

Deep-Fake CAPTCHA: Mitigating Next-Generation Social Engineering Attacks

This paper presents DF-CAPTCHA, an active defense against real-time deepfake impersonation in voice and video calls. Instead of passively searching for artifacts, DF-CAPTCHA prompts the caller to perform simple challenge-response tasks that are easy for humans but difficult for current real-time...

Linux Distros Unpatched Vulnerability : CVE-2026-80919

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive wwmutex acquire in amdgpudevcoredumpformat When dumping IB conten...

Linux Distros Unpatched Vulnerability : CVE-2026-80916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kcov: fix data corruption and race conditions on PREEMPTRT syzbot is reporting KCOV state corruption on PREEMPTRT kernels, for the temporary storage used for...

GHSA-HXJG-93WC-H8P8 Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

GHSA-2R5Q-H53F-9RP3 @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

Important: Red Hat Security Advisory: ansible-core security update

An update for ansible-core is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2022-22965-Spring4Shell-Security-Operations-Analysis

CVE-2022-22965 — Spring4Shell Security Operations Analysis A hands-on Security Operations Centre SOC simulation where I performed the role of an Information Security Analyst responding to an active Spring4Shell exploitation attempt. This repository documents the full incident response lifecycle —...

CVE-2026-71807

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

CVE-2026-24061

CVE-2026-24061: telnetd Authentication Bypass Vulnerability CVE-2026-24061 is an authentication bypass vulnerability in telnetd that allows attackers to bypass identity verification through specific combinations of environment variables and directly obtain a root-privileged shell. There is a flaw...

exploit_playground

About This is where I will post analysis of Public Exploits, or some of my 1day exploits. Public exploit analysis Personally I think the best way to learn a public exploit is by understanding it line-by-line until I can understand the exploit to the fullest. I will post some of these...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: cert-manager, kubernetes-dns-node-cache, kuma, newrelic-infrastructure-agent, sftpgo, kubernetes-csi-node-driver-registrar, flyte, grafana-rollout-operator, crossplane-provider-azure-storage, cilium, promxy, opentofu, kyverno-notation-aws, fulcio,...

CVE-2026-84445 vulnerabilities

Vulnerabilities for packages: cert-manager, kubernetes-dns-node-cache, kuma, newrelic-infrastructure-agent, sftpgo, kubernetes-csi-node-driver-registrar, flyte, grafana-rollout-operator, crossplane-provider-azure-storage, cilium, promxy, opentofu, kyverno-notation-aws, fulcio,...

PwnKit-Hunter

Background Last week, a significant vulnerability in polkit’s pkexec was publicly disclosed link. By exploiting this vulnerability, attackers on a vulnerable host could easily gain full root privileges from any unprivileged user. Following the public disclosure of this “PwnKit” vulnerability, we...

Jammer-Loc

Jammer-Loc 本存储库包含论文的代码和数据集链接 “用于室内 UWB 干扰源定位的机器与深度学习方法。” 使用示例 运行超参数优化过程： root@kitploit: python hpo.py \ --task classification \ --mode actual \ --framework ml \ --config config.yaml \ --trials 50 \ --study-name mystudy 1. 模型和指标必须由 main.py 以预期格式保存。 2. Optuna 结果默认保存到 hpo.db。 3. 所有命令行选项均在 hpo.py 中使用...

CVE-2026-1312

CVE-2026-1312 es una vulnerabilidad de inyección SQL de alto riesgo en Django: cuando se utiliza un alias de columna que contiene puntos en QuerySet.orderby, combinado con FilteredRelation para construir dinámicamente consultas mediante expansión de diccionarios, un atacante puede inyectar SQL...

MAL-2026-16097 Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...