CVE-2018-8897

CVE-2018-8897 Демонстрация эксплуатации уязвимости POP SS CVE-2018-8897, приводящая к выполнению неподписанного кода с привилегиями ядра. KVA Shadowing должен быть отключен, а соответствующее обновление безопасности удалено. Это может не работать с некоторыми гипервизорами например, VMWare, котор...

CVE-2025-4275

🐞 CVE-2025-4275: Hydroph0bia SecureFlash 인증서 섀도잉 이 저장소는 Insyde H2O 기반 UEFI 호환 펌웨어에 영향을 미치는 Secure Boot 우회 취약점인 CVE-2025-4275와 관련된 연구 자료를 담고 있습니다. 이 취약점에 대한 기술적 분석, 문제에 연루된 바이너리, 그리고 연구자들이 실제 환경과 교육적 맥락 모두에서 이 취약점을 더 잘 이해하고 연구하며 실험할 수 있도록 돕기 위한 문서와 도구를 한데 모았습니다. 📑 목차 최초 발견 및 공식 참고 자료 취약점 개요 분석,...

socgholish_finder

SocGholish Finder 웹사이트에서 SocGholish 인젝트를 스캔하는 간단한 스크립트입니다. 인젝트가 발견되면 확인하고 표시하며, 난독화를 해제하고 섀도잉 URL 도메인을 표시합니다. root@kitploit: usage: finder.py -h -url URL -ua USERAGENT -f FILENAME -p PROXY -s SocGholish finder options: -h, --help show this help message and exit -url URL URL to check -ua USERAGENT...

CVE-2026-80921

CVE-2026-80921 affects the Linux kernel in the KVM s390 vsie (Virtual SIE) subsystem. When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), bits 64–255 retain stale values from the vsie page, potentially allowing a nested guest to access a device no longer available . The CVSS 3.1...

CVE-2026-80921 KVM: s390: vsie: zero stale crypto bits

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

wheelaudit

wheelaudit Python Wheel 파일 보안 스캐너 — 설치 전에 .whl 파일의 보안 문제를 스캔합니다. 최근 Python wheel 처리에서 발생한 CVE에서 영감을 받았습니다: CVE-2026-24049 : wheel 압축 해제 시 경로 탐색으로 시스템 파일 권한 조작 가능 CVE-2026-1703 : pip가 wheel 아카이브를 설치할 때 발생하는 경로 탐색 Google GHSA-w97x-xxj5-gpjx : Python wheel의 Zip 파서 차등 취약점 의존성 제로. 단일 파일. Python 3.9+. ...

Linux Distros Unpatched Vulnerability : CVE-2026-80921

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in t...

CVE-2025-4275 — Updated!

🐞 CVE-2025-4275: Hydroph0bia SecureFlash Certificate Shadowing This repository contains research material related to CVE-2025-4275, a Secure Boot bypass vulnerability affecting UEFI-compatible firmware based on Insyde H2O. It centralizes technical analysis of the vulnerability, the binaries...

CVE-2026-79745

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-82862

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-82862

Hulumi versions prior to v1.3.2 are affected by a helper script shadowing vulnerability in which the threat-model helper script is resolved from an unsafe root . An attacker can place a malicious file in the workspace directory, causing it to be loaded in place of the intended helper script, resu...

CVE-2026-82862 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

EUVD-2026-68450

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-82862 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

EEF-CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Summary Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757

ash_admin (ash-project) is vulnerable to session/actor shadowing via a flawed client-side cookie reader. The JavaScript reads state cookies (e.g., actor_authorizing, actor_domain) using an unanchored regex (new RegExp(name + "=([^;]+)")) against document.cookie, so any cookie whose name merely en...

EUVD-2026-42434

RestrictedPython guard hooks can be shadowed via positional-only arguments...