internet-of-vulnerable-things

脆弱なモノのインターネット 脆弱なモノのインターネット をテーマにした私の小さなタームペーパーの成果です。 概要...

OpenSTAManager_RCE_Exploit-CVE-2026-38751-

OpenSTAManager RCE エクスプロイト CVE-2026-38751 概要 このPythonスクリプトは、CVE-2026-38751として識別されたOpenSTAManagerバージョン2.10のリモートコード実行の脆弱性を悪用します。このエクスプロイトにより、認証されたユーザーは悪意のあるモジュールをアップロードし、ターゲットシステム上で任意のコマンドを実行できます。 脆弱性詳細 CVE ID : CVE-2026-38751 製品 : OpenSTAManager バージョン : 2.10 タイプ : リモートコード実行 RCE 攻撃ベクトル :...

CLSA-2026-1790765563 TuxCare security update for fast-uri (2 CVEs)

TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 3.0.1-tuxcare.5...

update-apt-package

剧本更新APT包，因为CVE-2019-3462...

CVE-2025-61228

CVE-2025-61228 注意 この問題は開発者が示唆するよりも深刻なようです。そのため、この部分が埋もれてしまわないようにしたいと思います。開発者はブログで次のように述べています: これは、お使いのシステム上で動作中のプログラムが SuperDuper の更新を探していて、正規の手段で実際の更新が提示され、あなたが「アップグレード」をクリックした場合にのみ発生します。 これは実際には正しくありません。この脆弱性を悪用するために、正規の手段で実際の更新が提示される必要はありません。SuperDuper 3.10 以前が提供する更新は、絶対に受け入れないでください!...

CLSA-2026-1790759630 TuxCare security update for vite (2 CVEs)

TuxCare rebuilt vite to address 2 CVEs. Fixed in 7.3.3-tuxcare.1...

CLSA-2026-1790759588 TuxCare security update for fast-uri (1 CVE)

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 2.4.0-tuxcare.3...

CLSA-2026-1790758113 TuxCare security update for vite (2 CVEs)

TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.9-tuxcare.1...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.49 bug fix and security update

Red Hat OpenShift Container Platform release 4.19.49 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

CLSA-2026-1790754735 TuxCare security update for pillow (8 CVEs)

TuxCare rebuilt pillow to address 8 CVEs. Fixed in 8.4.0.post8+tuxcare...

CVE-2025-14221

説明 1. CVE-2025-14221 2. 発見者: Fatma Trabelsi 3. 製品ベンダー: SourceCodester 4. 影響を受ける製品: Online Banking System 1.0 POC アプリケーションのユーザープロファイル更新機能に、格納型クロスサイトスクリプティング（XSS）の脆弱性が存在します。アプリケーションは、名前フィールドに入力されたユーザー提供データをデータベースに保存し、複数のページで表示する前に適切にサニタイズできていません。...

ROOT-APP-NPM-CVE-2026-47137 CVE-2026-47137 in vm2 - Patched by Root

Root has patched CVE-2026-47137 in the vm2 package for Root:npm. Multiple fixed versions available...

CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-85576

The All in One Files Upload WordPress plugin, specifically versions before 2.0.17 , is vulnerable to an unauthorized settings modification. The root cause is a lack of capability checks and a failure to verify the authenticity of the request when saving plugin settings. This flaw allows any authe...

CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

WordPress All in One Files Upload plugin < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin All in One Files Upload versions 2.0.17...

CLSA-2026-1790747802 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post22+tuxcare...

Ivanti Endpoint Manager - Authentication Bypass

Ivanti Endpoint Manager 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges. id: CVE-2026-1603 info: name: Ivanti Endpoint Manager - Authentication Bypass author:...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

Wavlink Multiple AP - Remote Command Injection

Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink...