Lucene search
+L

30 matches found

Kitploit
Kitploit
added 2026/09/21 5:20 p.m.5 views

CVE-2026-39987.py

CVE-2026-39987.py このPythonスクリプトは、脆弱なmarimo /terminal/wsエンドポイントを悪用し、インタラクティブシェルを返します。 使用方法 : 行う必要がある唯一の変更は、スクリプト内のHOST変数を変更することです。 HOST変数を変更したら、以下の例のようにターミナルでスクリプトを実行してください: 使用例: python3 CVE-2026-39987.py -- ターゲットが脆弱な場合、インタラクティブシェルが開始されます -- CVE-2026-39987の詳細については、このリンクを開いてください -...

9.8CVSS8AI score0.99564EPSS
SaveExploits26
Kitploit
Kitploit
added 2026/09/15 6:44 p.m.10 views

CVE-2026-39987

CVE-2026-39987 — Marimo の事前認証RCE(Terminal WebSocket経由) root@kitploit: / / | / / / | \ / \ \ / / | // / \ / / | | / / // // / / // // \ / ステータス: 0.23.0 でパッチ適用済み — marimo-team/marimo@c24d480 脆弱性 /terminal/ws エンドポイントには、他のすべての認証済みエンドポイントに存在する validateauth 呼び出しがありません: root@kitploit: ❌ /terminal/ws —...

9.8CVSS8.3AI score0.99564EPSS
SaveExploits26References4
GithubExploit
GithubExploit
added 2026/08/20 7:25 p.m.25 views

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987.py This python script exploit the vulnerable ma...

9.8CVSS8.2AI score0.99564EPSS
SaveExploits26
OSV
OSV
added 2026/08/19 8:36 p.m.16 views

CVE-2026-53546 Termix: Missing authorization in SSH host credential resolution exposes stored credentials

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...

9.6CVSS5.5AI score
SaveExploits0References6
CVE
CVE
added 2026/08/19 8:36 p.m.29 views

CVE-2026-53546

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing. Prior to 2.3.2 , the terminal WebSocket accepts a user-controlled hostConfig.id, and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access . When no creden...

9.6CVSS5.4AI score0.00443EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/04 11:34 a.m.11 views

PYSEC-2026-3595 Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

7.1CVSS5.5AI score0.00456EPSS
SaveExploits1References7
PyPA
PyPA
added 2026/08/04 11:34 a.m.30 views

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

SummaryWith Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perform...

7.1CVSS5.5AI score0.00456EPSS
SaveExploits1References7Affected Software1
GithubExploit
GithubExploit
added 2026/08/02 5:34 p.m.33 views

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypa...

9.8CVSS5.9AI score0.99564EPSS
SaveExploits26
OSV
OSV
added 2026/07/24 5:00 p.m.15 views

GHSA-855V-HQ7W-JMJW Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

7.1CVSS5.8AI score0.00456EPSS
SaveExploits1References5
EUVD
EUVD
added 2026/07/07 2:54 a.m.13 views

EUVD-2026-41981

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources...

9.9CVSS6AI score0.00711EPSS
SaveExploits0References4
PyPA
PyPA
added 2026/06/29 11:50 a.m.19 views

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

SummaryMarimo 19.6k stars has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands.Unlike other WebSocket endpoints e.g., /ws that correctly...

9.8CVSS7.6AI score0.99564EPSS
SaveExploits26References10Affected Software1
OSV
OSV
added 2026/06/29 11:50 a.m.32 views

PYSEC-2026-407 Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

Summary Marimo 19.6k stars has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints e.g., /ws that correct...

9.8CVSS7.7AI score0.99564EPSS
SaveExploits26References10
GithubExploit
GithubExploit
added 2026/06/02 8:37 a.m.131 views

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 - a full PTY shell Unauthenticated Stored Cross...

9.8CVSS7.5AI score0.99564EPSS
SaveExploits26
GithubExploit
GithubExploit
added 2026/05/04 10:54 a.m.163 views

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — marimo Pre-Auth Terminal WebSocket RCE Lab...

9.8CVSS7.9AI score0.99564EPSS
SaveExploits26
Tenable Nessus
Tenable Nessus
added 2026/04/24 12:00 a.m.11 views

Python Library marimo < 0.23.0 Pre-Auth RCE (CVE-2026-39987)

The detected version of the marimo Python package is prior to 0.23.0. It is, therefore, affected by a remote code execution vulnerability: - The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute...

9.8CVSS8.2AI score0.99564EPSS
SaveExploits26References2
GithubExploit
GithubExploit
added 2026/04/18 7:46 a.m.177 views

Exploit for CVE-2026-39987

CVE-2026-39987 marimo is a reactive Python notebook. Prior to...

9.3CVSS7.7AI score0.99564EPSS
SaveExploits26
GithubExploit
GithubExploit
added 2026/04/15 8:09 a.m.193 views

Exploit for CVE-2026-39987

CVE-2026-39987 — Marimo Python Notebook Pre-Authenticated Remo...

9.3CVSS6.9AI score0.99564EPSS
SaveExploits26
GithubExploit
GithubExploit
added 2026/04/13 6:06 p.m.169 views

Exploit for CVE-2026-39987

markdown CVE-2026-39987 - Marimo Este script es SOLO para f...

9.3CVSS5.9AI score0.99564EPSS
SaveExploits26
The Hacker News
The Hacker News
added 2026/04/10 7:37 a.m.17 views

Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure

A critical security vulnerability in Marimo, an open-source Python notebook for data science and analysis, has been exploited within 10 hours of public disclosure, according to findings from Sysdig. The vulnerability in question is CVE-2026-39987 CVSS score: 9.3, a pre-authenticated remote code...

9.8CVSS8.2AI score0.99564EPSS
SaveExploits26
NVD
NVD
added 2026/04/09 6:17 p.m.13 views

CVE-2026-39987

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSock...

9.8CVSS0.99564EPSS
SaveExploits26References5
Rows per page
Query Builder