CVE-2020-16125-Reproduction

CVE-2020-16125-Reproducción Este repositorio tiene como objetivo reproducir el ataque. Descripción: Su nombre original es "Ubuntu gdm3 escalada de privilegios" y fue encontrado por un investigador de seguridad de Github llamado Kevin Backhouse. Su puntuación CVSS es 4.6/10 media y el entorno...

CVE-2023-38646

CVE-2023-38646 El script original proviene de securezeron Durante mis pruebas, descubrí que la shell inversa generada por este PoC fallaba en la explotación tras la codificación base6 debido al carácter '=' al final. Lo modifiqué ligeramente para resolver este problema. 原始的生成reverse shell负载的代码...

SVPT_CW_2

CVE-2024-21413 https://github.com/KartheekKandalam99/SVPTCW2 Configuración de CVE-2024-21413 para CW TRYHACKME proporcionó una sala para trabajar en esta vulnerabilidad. A continuación se encuentra el enlace para acceder a la sala https://tryhackme.com/r/room/monikerlink Para acceder a la sala a...

rex-sec-glibc

rex-ossec-base setup Actualizará los archivos glibc según sea necesario. check Verificará los paquetes glibc tal como están. task "setup", make Rex::Collectd::Base::setup; ;...

Metabase-Setup-Endpoint-SQLi-Fix

CVE-2026-72898: Parche para la inyección SQL en el endpoint de configuración de Metabase Este repositorio contiene el hotfix para CVE-2026-72898 , una vulnerabilidad de inyección SQL no autenticada en el endpoint de configuración de instancias de Metabase autoalojadas. Sin el parche, los atacante...

CVE-2026-100570

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

CVE-2026-100540

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100570

The OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and

CVE-2026-100570 OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

CVE-2026-100570 OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

EUVD-2026-87481

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

CVE-2026-100570 OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

CVE-2026-100540

Versions of OpenClaw Feishu prior to 2026.8.1 are vulnerable to an authentication bypass because the system fails to verify if a configured default account is disabled before using it for model tool operations. In multi-account configurations, an attacker can exploit a disabled default account th...

EUVD-2026-87510

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

DEBIAN-CVE-2026-93260

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xiveinitipis fails e.g. irqdomainallocirqs fails, the error path frees the global xiveipis array. However, xivesmpprobe previously ignored this failure and...

EUVD-2026-86132

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xiveinitipis fails e.g. irqdomainallocirqs fails, the error path frees the global xiveipis array. However, xivesmpprobe previously ignored this failure and...

Cross-site Scripting (XSS)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

CVE-2026-94218

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

PT-2026-96049

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the authentication session management allows users to bypass mandatory security requirements, such as two-factor authentication 2FA setup, enforced via client policies. By manually...

OESA-2026-3945 docker security update

Security Fixes: Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or...