-Educational-PoC-CVE-2026-23520

CVE-2026-23520: Протокол контекста модели MCP Подключение RCE - Образовательный PoC - Arcane ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ: Данный репозиторий и содержащиеся в нём скрипты предназначены строго для образовательных и академических целей. Предоставленная информация предназначена для помощи специалистам п...

CVE-2026-23744

CVE-2026-23744: Preuve de concept d'exécution de code à distance non authentifiée AVERTISSEMENT : Ce dépôt et les scripts associés sont destinés uniquement aux évaluations de sécurité autorisées, aux tests d'intrusion, à la recherche en sécurité et à l'analyse éducative. Tester des systèmes sans...

CVE-2026-23744-RCE

MCPJam Inspector v1.4.2 - RCEエクスプロイト 脆弱性の説明 MCPJam Inspectorには、/api/mcp/connect エンドポイントに認証不要のリモートコード実行（RCE）脆弱性があります。この脆弱性により、攻撃者は悪意のあるMCPサーバー設定ペイロードを送信することで任意のコマンドを実行できます。 このエンドポイントは、serverConfig オブジェクトを含むJSONペイロードを受け入れ、そのオブジェクトには command と args 配列が含まれており、適切な検証やサニタイズなしでシステム上で直接実行されます。 影響を受けるバージョン...

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2 Une vulnérabilité critique d'exécution de code à distance RCE dans MCPJam Inspector 3. Lancer l'exploit root@kitploit: python3 CVE-2026-23744.py -u -i -p 4. Pour une meilleure utilisation, je recommande de mettre à jour le terminal vers un terminal...

CVE-2026-23744-POC

CVE-2026-23744 — MCPJam Inspector RCE non authentifié MCPJam Inspector = 1.4.2 se lie à 0.0.0.0 par défaut et expose /api/mcp/connect sans aucune authentification. Le point d'accès accepte un objet serverConfig qui lance un processus directement sur l'hôte — transmettre une charge utile de revers...

CVE-2026-23744

CVE-2026-23744 — MCPJam Inspector: неаутентифицированное удалённое выполнение кода PoC для неаутентифицированного удалённого выполнения кода через CVE-2026-23744. MCPJam Inspector 1.4.2 и более ранние версии открывают функциональность через /api/mcp/connect, которая позволяет запустить управляему...

CVE-2026-35085

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root...

CVE-2026-35085

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root...

CVE-2026-35085

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root...

CVE-2026-35085 Stack buffer overflow in method gdv-serverconfig

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root...

CVE-2026-35085

CVE-2026-35085 describes a stack buffer overflow in gdv-serverconfig that can be exploited by a remote attacker authenticated with user privileges to achieve full system access as root. The CVE is rated HIGH (CVSS 4.0: 8.7) with NETWORK attack vector, low complexity, and requires low privileges; ...

CVE-2026-35085 Stack buffer overflow in method gdv-serverconfig

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root...

EUVD-2026-34081

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root...

MBS多款产品 安全漏洞

MBS Single-A and other products are a series of industrial communication gateways developed by the German company MBS. Several MBS products have security vulnerabilities; these vulnerabilities stem from a stack buffer overflow in the gdv-serverconfig module, which could allow remote attackers to...

PT-2026-45926

Name of the Vulnerable Software and Affected Versions gdv-serverconfig affected versions not specified Description A remote attacker with user privileges can exploit a stack buffer overflow in the gdv-serverconfig method to gain full system access with root privileges. A stack buffer overflow...

EUVD-2025-27769

Malicious code in bioql PyPI...

PT-2025-34849 · Unknown · Serverconfig

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: The serverConfig API endpoint returns the module configuration, including credentials, without requiring authentication. Recommendations: At the moment, there is no information about a newer versio...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2779)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300052.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2779 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause ...

Security Bulletin: Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass affects watsonx.data

Summary Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass, which could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-45337 DESCRIPTION: Applications and libraries which misuse connection.serverAuthenticate...

Important: containerd

Issue Overview: Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to...