CVE-2026-27597

CVE-2026-27597 - バージョン リモートコード実行 クイック使用方法 root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe 悪用に関する注意事項 深刻度: CRITICAL CVSS: 10.0 影響: 機密性、完全性、可用性 公開日: 2026-02-25 技術概要 Enclave は、安全な AI エージェントコード実行のために設計されたセキュアな JavaScript サンドボックスです。バージョン 2.11.1...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby4.0: ruby4.0-4.0.6-37.3.hum1 aarch64, x8664 ruby4.0-bundled-gems-4.0.6-37.3.hum1 aarch64, x8664 ruby4.0-default-gems-4.0.6-37.3.hum1 noarch ruby4.0-devel-4.0.6-37.3.hum1 aarch64, x8664...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.3: ruby3.3-3.3.10-23.6.hum1 aarch64, x8664 ruby3.3-bundled-gems-3.3.10-23.6.hum1 aarch64, x8664 ruby3.3-default-gems-3.3.10-23.6.hum1 noarch ruby3.3-devel-3.3.10-23.6.hum1 aarch64, x8664...

GHSA-J4FX-XXWH-2485 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu...

CVE-2026-8657 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu...

GHSA-J4FX-XXWH-2485 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu...

GHSA-78XM-G482-CH2R vulnerabilities

Vulnerabilities for packages: elasticsearch...

GHSA-CPH5-M8F7-6C5X vulnerabilities

Vulnerabilities for packages: arangodb...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.45 bug fix and security update

Red Hat OpenShift Container Platform release 4.19.45 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

ECHO-C875-8817-B874

Bulletin has no description...

Jenkin Audit Trail <=3.2 - Cross-Site Scripting

Jenkins Audit Trail 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. id: CVE-2020-2140 info: name: Jenkin Audit Trail =3.3 which includes a fix for this vulnerability. reference: -...

Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting

Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/mynotifications NEWUINAV parameter. id: CVE-2021-36450 info: name: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting author: atomiczsec severity: medium description: Verint...

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

WAGO - Remote Command Execution

In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise. id: CVE-2023-1698 info: name: WAGO - Remote Command Execution...

Ivanti Connect Secure - Stack-based Buffer Overflow

Ivanti Connect Secure 22.7R2.5, Ivanti Policy Secure 22.7R1.2, and Ivanti Neurons for ZTA gateways 22.7R2.3 contain a stack-based buffer overflow in the clientCapabilities parameter handling. This vulnerability allows remote unauthenticated attackers to execute arbitrary code through IF-T TLS...

Vite - Arbitrary File Read

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

Yii 2 < 2.0.38 - Remote Code Execution

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. id: CVE-2020-15148 info: name: Yii 2 2.0.38 - Remote Code Execution author: pikpikcu severity: critical description: Yii 2 yiisoft/yii2 before version 2.0....

XStream <1.4.15 - Server-Side Request Forgery

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...

Citrix - Local File Inclusion

Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 are vulnerable to local file inclusion because they allow unauthenticated access to certain URL endpoints. id:...