CVE-2024-26144-test

CVE-2024-26144-test 必要条件: Docker compose Deno $ deno run --allow-run --allow-net check.ts CDNをテストしたい場合は、引数にURLを設定してください。 （実行前にすべてのキャッシュが削除されていることを確認してください！） $ deno run --allow-run --allow-net check.ts https://example.com/ 結果 HTTPレスポンスに Set-Cookie ヘッダーが含まれる場合... Webサーバー| レスポンスがキャッシュされるか 1|...

CVE-2023-43208_Detection_PoC

CVE-2023-43208DetectionPoC java.net.InetAddress を使用して検出 POST /api/users HTTP/1.1 Host: ip:8443 User-Agent: Mozilla/5.0 X11; CrOS x8664 14541.0.0 AppleWebKit/537.36 KHTML, like Gecko Chrome/120.0.0.0 Safari/537.36 Connection: keep-alive Content-Length: 1964 Content-Type: application/xml...

SocialEngineering-Templates

SocialEngineering-Templates SETフレームワークのテンプレート...

CVE-2026-88038

A flaw was found in the cookies Node.js library. This vulnerability allows a remote attacker to inject additional cookie attributes into the Set-Cookie header by providing untrusted data to the domain or path options. This occurs because the library's validation for these options is permissive,...

CVE-2026-100381

CVE-2026-100381：Flickr 集合与图集标题中的 DOM XSS 报告者：Marco Paciaroni（BomboBombone）。 UploadWizard 通过一个将字符串解释为 HTML 的 API 插入 Flickr 集合与图集标题。因此，外部标题元数据可能成为 wiki 页面中的可执行标记。 受影响版本 CVE 记录指出，受影响的 UploadWizard 发布分支为 1.46.1、1.45.5 和 1.43.10 中修复之前的版本。请使用对应 MediaWiki 发布分支的已修复扩展代码。 影响与条件 必须启用 Flickr...

CVE-2024-23339

CVE-2024-23339 脆弱性の概要 CVE-2024-23339 CVSS : 6.5 Jan 23, 2024 ProtoType Pollution in node.js package rebobプロジェクトの一環として 脆弱性の説明 GitHubアドバイザリ hoolock...

Openbsd-Privilege-Escalation

Openbsd-Privilege-Escalation OpenBSDシステム上で特権昇格のプロセスを自動化するスクリプトです。CVE-2019-19520 xlockバイナリを悪用してそのsgidを取得し、CVE-2019-19522 authグループの権限を悪用してSkeyまたはYubikeyに鍵を追加することで、rootユーザーに昇格します。 Cコードは、元のPoC（https://www.openwall.com/lists/oss-security/2019/12/04/5）をほぼコピーしたものです。 CVE-2019-19522:...

Exploit for CVE-2026-92592

CVE-2026-92592: Craft CMS authenticated RCE Proof of concept...

PT-2026-104550

Name of the Vulnerable Software and Affected Versions Burst Statistics – Simple WordPress Analytics Google Analytics Alternative versions prior to 3.7.2 Description Improper authentication allows for account persistence. The maybe load shared dashboard handler issues a genuine WordPress session...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: xeol, manifest-tool, k9s, gitness, cert-manager-cmctl, helm-push, helm-mapkubeapis, kargo, k8sgpt, kube-arangodb, maru, kyverno-notation-aws, opentofu, rancher-helm, tigera-operator, helm-set-status, flux-helm-controller, cluster-api-helm-controller...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: xeol, manifest-tool, k9s, gitness, cert-manager-cmctl, helm-push, helm-mapkubeapis, kargo, k8sgpt, kube-arangodb, maru, kyverno-notation-aws, opentofu, rancher-helm, tigera-operator, helm-set-status, flux-helm-controller, cluster-api-helm-controller...

Security Bulletin: Vulnerability in immutable bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the immutable library, which is affected by a denial of service vulnerability. CVE-2026-59879, CVE-2026-59880. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many Persistent Immutable data...

PT-2026-104090

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

PT-2026-104080

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

SummaryA malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because RSAAlgorithm.fromjwk can raise a plain ValueError that isn't caught by PyJWKSet's per-key error-skipping logic. Affected component / version- Package: PyJWT PyPI, ecosystem pip- Files:...

PYSEC-2026-4152 PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

Summary A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because RSAAlgorithm.fromjwk can raise a plain ValueError that isn't caught by PyJWKSet's per-key error-skipping logic. Affected component / version - Package: PyJWT PyPI, ecosystem pip - Files...

immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as Listset or ListsetSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providin...

Rocky Linux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783522215)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783522215 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17...

PT-2026-103692

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher...

PT-2026-103717

Name of the Vulnerable Software and Affected Versions The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions prior to 2.15.1 Description An authentication bypass exists in the login customer after checkout function via the checkout form parameter. The issue occurs because the...