EUVD-2026-107167

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

CVE-2026-59229

Apache IoTDB (versions 2.0.0 before 2.0.11) is vulnerable to a privilege escalation issue in the Legacy Pipe receiver protocol (handshake / sendPipeData). The vulnerability arises because the protocol uses a hardcoded SUPER_USER (root) identity to execute data loading and deletion operations. Con...

htb-paperwork-poc

HTB · PaperWork — PoC Proof-of-concept per la macchina Pape...

CVE-2026-70386

OnePlus OxygenOS on Android is vulnerable to an OS command injection and Missing Authorization vulnerability. A locally installed application can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain without user interaction. The flaw arises because the atlasservice bin...

Hijacker

Hijacker Hijacker is a Graphical User Interface for the penetration testing tools Aircrack-ng, Airodump-ng, MDK3 and Reaver. It offers a simple and easy UI to use these tools without typing commands in a console and copy&pasting MAC addresses. This application requires an ARM android device with ...

CVE-2026-114107

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CVE-2026-114108

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because requireauth returns early when APIAUTHKEY is unset. Attackers can post messages to /sessions/id/messages to trigger root shell...

CVE-2026-114108 HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because requireauth returns early when APIAUTHKEY is unset. Attackers can post messages to /sessions/id/messages to trigger root shell...

EUVD-2026-106911

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because requireauth returns early when APIAUTHKEY is unset. Attackers can post messages to /sessions/id/messages to trigger root shell...

CVE-2026-114108 HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because requireauth returns early when APIAUTHKEY is unset. Attackers can post messages to /sessions/id/messages to trigger root shell...

CVE-2026-114108

The software HKUDS Vibe-Trading (versions 0.1.0 before 0.1.7) is vulnerable to a missing authentication flaw in its FastAPI server. The root cause is that the require_auth() function returns early when the API_AUTH_KEY is unset, granting unauthenticated attackers access to the application surface...

EUVD-2026-106910

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CVE-2026-114107

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CVE-2026-114107 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CVE-2026-114107

HKUDS Vibe-Trading versions 0.1.0 before 0.1.7 are vulnerable to an indirect prompt injection vulnerability. The root cause lies in BashTool and BackgroundRunTool , which pass model-emitted commands to subprocess.run with shell=True without an allow-list or approval step. Additionally, the read_u...

CVE-2026-114107 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CVE-2026-114069 Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGERSECRETKEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key c...

CVE-2026-114069 Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGERSECRETKEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key c...

CVE-2026-114069

The software Trigger.dev before version 4.6.0 is affected by an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint. This flaw allows attackers possessing a restricted read:envvars key to access the environment's root API key (labeled as TRIGGER_SECRET_KE...