GHSA-83VG-56QC-22M7 GitPython validates a submodule's ".git" path only after cloning into it (RCE)

Summary createsubmodulename, path, url clones a submodule into the repo's own .git directory before it rejects the path. A path of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named post-checkout in the submodule...

EUVD-2026-107557

GitPython validates a submodule's ".git" path only after cloning into it RCE...

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

Summary createsubmodulename, path, url clones a submodule into the repo's own .git directory before it rejects the path. A path of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named post-checkout in the submodule...

CobaltWhispers

CobaltWhispers Author: @Cerbersec CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV. CobaltWhispers is powered by SysWhispers2 and InlineWhispers...

dump

Dump This repository contains dead/unfinished projects, small scripts or stuff that doesn't deserve a repository of its own. Contents git-gat : post-exploitation script for finding private git repos Infinity dead : find phone number of any Facebook user. json2paths : converts JSON keys to paths f...

SUSE CVE-2026-85518

A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted...

CVE-2025-24893

CVE-2025-24893 XWiki RCE Vulnerability Analysis Environment Setup 1. Running XWiki 15.10.10 Environment docker-compose up -d 2. Accessing XWiki URL: http://localhost:8080 Proceed with testing after completing the initial setup Create an admin account after accessing the initial page Install XWiki...

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

GHSA-H895-CGQG-JF52 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...

sysmon-config

sysmon-config | A Sysmon configuration file for everybody to fork This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. The file should function as a great starting point for system change monitoring in a self-contained and accessible package...

Aaia

NOTE This repository is not under active development. However, I am open to accepting PRs. Aaia still works as there has been no significant changes in terms of AWS APIs it uses to collect data. Aaia Analysis of Identity and Access Note: Expansion created post the name was decided :P What does Aa...

cleverhans

CleverHans latest release: v4.0.0 This repository contains the source code for CleverHans, a Python library to benchmark machine learning systems' vulnerability to adversarial examples. You can learn more about such vulnerabilities on the accompanying blog. The CleverHans library is under continu...

SUSE CVE-2026-92539

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2021-3560_Polkit

CVE-2021-3560 Polkit Local Privilege Escalation .--. .-" "-. .--. / .. / .-. .-. / .. \ | | '| / Y \ |' | | | \ \ \ 0 | 0 / / / | \ '- ,.-" "-./, -' / '-' / ^ ^ \ '-' .--'| . ./ |'--. / \ \ / / \ / '. '---' .' \ / '---' \ / \ An automated exploit for the CVE-2021-3560 vulnerability affecting...

geoip-attack-map

First and Foremost I do not have much time in my life right now to maintain this project. I undertook this challenge as a means to learn JavaScript, and to improve upon the Python I already knew. I'm sure there are several things I could have done differently in my implementation, and I won't be...

SUSE CVE-2026-98484

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip expired catchall elements on insert and delete nftsetelemcatchallinsert looks up duplicates with nftsetelemactive only, while nftsetcatchalllookup and the dump path additionally skip expired elements. On...

CVE-2022-0853

CVE-2022-0853 CVE-2022-0853 A memory leak on the jboss client side, when using UserTransaction repeatedly. Such as: private void testTransaction throws Exception forint i=1; i 500000; i++ System.out.println"Starting process " + i; // get the UserTransaction and EJB Proxy Context ctx =...

CVE-2024-47176

CVE-2024-47176 — Remote Command Execution in CUPS For educational and authorized penetration testing purposes only. Table of Contents Description Affected Systems Related CVEs Prerequisites Setup Usage Disclaimer Description CUPS Common UNIX Printing System is an open-source printing system that...

CVE-2025-47916

CVE-2025-47916 - Invision Community Remote Code Execution RCE Vulnerability About This repository provides a proof‑of‑concept description for CVE‑2025‑47916 , a Remote Code Execution vulnerability affecting Invision Community versions 5.0.0 through 5.0.6. The issue stems from improper handling of...