760 matches found
nodejsscan
nodejsscan Static security code scanner SAST for Node.js applications powered by libsast and semgrep. Made with in India...
Docker-Security
Docker Security これはOWASP Docker Top 10です。作業中のドキュメントです。 このドキュメントについて このドキュメントは、セキュアなコンテナ化環境を構築するための最も重要な10のセキュリティ項目を説明しています。ゼロから始める場合の仕様書として使用でき、また、この作業を委託する業者に渡すこともできます。...
CVE-2022-40146_Exploit_Jar
Apache Batik SSRF から RCE への Jar エクスプロイト コンポーネントリンク https://github.com/apache/xmlgraphics-batik ブログ https://www.zerodayinitiative.com/blog/2022/10/28/vulnerabilities-in-apache-batik-default-security-controls-ssrf-and-rce-through-remote-class-loading 使用方法 src/main/java/com.poc.Poc.java の 11...
EAST
확장 가능한 Azure 보안 도구 확장 가능한 Azure 보안 도구이하 E.A.S.T는 Azure 및 일부 Azure AD 보안 제어를 평가하기 위한 도구입니다. EAST의 주요 사용 사례는 Azure 평가에서 평가를 위한 보안 데이터 수집입니다. 이 정보JSON 콘텐츠는 다양한 보고 도구에서 사용될 수 있으며, 이를 통해 데이터를 추가로 상호 연관시키고 조사합니다. 이 도구는 MIT 라이선스에 따라 라이선스가 부여됩니다. 협력자 본인 Nixu 클라우드 보안 팀 목차 확장 가능한 Azure 보안 도구 협력자 릴리스 노트 중요 ...
CVE-2026-79724
IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an OS command injection vulnerability (CWE-78) caused by multiple incomplete code security controls and missing execution guards, including an incomplete denylist omitting process-spawning primitives, a logic error in the code scanner...
CVE-2026-81204
IBM Langflow OSS (versions 1.0.0 through 1.11.5) is vulnerable to unauthenticated remote code execution (CVSS 9.8, CRITICAL) caused by code injection during graph construction (CWE-94). The root cause involves the lfx CodeParser passing return-type annotation source directly to eval without sanit...
kernel: sctp: auth: verify auth requirement when auth_chunk is NULL
A flaw was found in the Stream Control Transmission Protocol SCTP authentication mechanism within the Linux kernel. The sctpauthchunkverify function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific condition...
CVE-2026-62388
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...
MINI-9G85-XMH9-X3WG
Bulletin has no description...
CVE-2026-68300
A flaw was found in the Stream Control Transmission Protocol SCTP authentication mechanism within the Linux kernel. The sctpauthchunkverify function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific condition...
PYSEC-2026-3536 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse" binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controls origin...
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier URI that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw...
dotnet: .NET: Security feature bypass due to incorrect authorization
A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system...
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier URI that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw...
CVE-2026-5051
A flaw was found in HashiCorp Vault and Vault Enterprise. The audit device validation logic did not consistently apply plugin directory protections when a legacy file audit path option was used. This inconsistency could allow an attacker to bypass security controls, potentially leading to...
PYSEC-2026-448 PandasAI interactive prompt function Remote Code Execution (RCE)
PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution RCE instead of the intended explanation of the natural language processing by the LLM. The security controls of PandasAI 2.4.3 and earlier fail ...
CVE-2026-44018
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS...
CVE-2026-12797
A flaw was found in BerriAI litellm. A remote attacker could manipulate the prompt argument in the asyncprecallhook function of the Completions Interface component. This manipulation leads to incorrect authorization, potentially allowing the attacker to bypass security controls and perform...
CVE-2026-8646
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security...
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse" binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controls origin...