RabbitMQ 4.0.x < 4.0.23 / 4.1.x < 4.1.14 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Shovel Credential Disclosure via Crash Report

The version of RabbitMQ installed on the remote host is 4.0.x prior to 4.0.23, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by an information disclosure vulnerability: - The Shovel worker processes do not implement the formatstatus callbac...

PT-2026-104403

Name of the Vulnerable Software and Affected Versions Tinypool versions prior to 2.1.2 Description Tinypool reads the filename from a caller-supplied options object in the pool.runtask, options function without verifying if the property is an own property of the object. This allows a polluted...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

Critical: Red Hat Security Advisory: Satellite 6.16.14 Async Update

An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

DEBIAN-CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

CVE-2026-86344 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

CVE-2026-86344

A flaw in 389-ds-base allows an unauthenticated remote attacker to perform a denial of service (DoS) attack. By sending a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on a single connection, the attacker can force the server to hand that connection to a second ...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

CVE-2026-25769

🚨 CVE-2026-25769 - Wazuh 不安全反序列化远程代码执行 关键型 Worker ➜ Master 远程代码执行（Wazuh 集群模式） Wazuh 集群通信中的不安全反序列化允许被攻破的 worker 节点 在 master 节点 上实现 root 权限的远程代码执行 。 📌 概述 CVE ID: CVE-2026-25769 产品: Wazuh 受影响版本: 4.0.0 → 4.14.2 修复版本: 4.14.3 严重性: 严重 CVSS v3.1: 9.1 CWE: CWE-502 — 不可信数据的反序列化 Wazuh 集群模式中的一个严重漏洞允许具有 worke...

CVE-2026-23918-Apache-H2-PoC

CVE-2026-23918-Apache-H2-PoC これはApacheのmodhttp2（CVE-2026-23918）におけるdouble-free脆弱性の概念実証エクスプロイトです。h2mplx.cのストリームクリーンアップパスに影響する厄介なバグです。 基本的に、タイミングをうまく合わせれば、サーバーに同じストリームを2回クリーンアップさせることができ、通常はSIGSEGVとワーカークラッシュを引き起こします。 法的な注意事項...

ls-poc

CVE-2026-30368 概念実証コード !IMPORTANT これはパッチ適用済みであり、現在は認証情報が必要です。回避策を使用して自分自身に対して操作を実行してください。 はじめに CVE-2026-30368 により、攻撃者は Lightspeed Classroom 管理の脆弱な認証の欠陥を介して生徒のデバイスを制御できます。 この POC（poc.js）は、LS Classroom 拡張機能のサービスワーカーをグローバルコンテキストで実行します。ワーカーは一部の機能で classroom.wasm も実行します。wasm-loader.js...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

EUVD-2026-90364

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env...

CVE-2026-42945

CVE-2026-42945 PoC（Go） 한국어 | English nginx HTTP/2 구현CVE-2026-42945 에 대한 탐지 및 익스플로잇 보조 도구로, 승인된 환경 에서 취약점 존재 여부 확인, 패치 효과 대조, 제어 가능한 실험 환경에서 PoC 동작 재현을 위해 사용됩니다. 영향받는 버전대략: nginx 0.6.27 – 1.30.0 ; 1.30.1+ / 1.31.0+ 에서 수정됨. ⚠️ 면책 조항 반드시 읽어주세요 본 저장소는 보안 연구, 취약점 검증 및 방어적 테스트 목적으로만 제공됩니다. 1. 합법적 권한 :...

CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

fix_nginx_cve_2026_42945

NGINX CVE-2026-42945 원클릭 복구 스크립트 자동으로 시스템 배포판을 감지하여 NGINX를 수정 버전≥1.30.1으로 업그레이드하고, 설정을 백업하며 자동 롤백을 수행합니다. 취약점 설명 취약점 번호： CVE-2026-42945 취약점 이름：NGINX Rift NGINX가 특정 rewrite 리디렉션 규칙을 처리할 때 요청 콘텐츠 길이 계산이 실제 쓰기와 일치하지 않습니다. 공격자는 악의적인 요청을 구성하여 메모리 손상을 유발하고, 작업자 프로세스를 충돌시키거나 원격 코드 실행을 초래할 수 있습니다. 영향받는 버...

PT-2026-103842

A flaw was found in ansible-runner. The unstream dir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

PT-2026-104053

Name of the Vulnerable Software and Affected Versions 389-ds-base affected versions not specified Description An unauthenticated remote attacker can cause a denial of service by sending a complete LDAP operation followed by the initial bytes of an incomplete LDAPMessage on the same connection. Th...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2025_1351)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20251351 advisory. undici: Undici Uses Insufficiently Random Values CVE-2025-22150 nodejs: Node.js Worker Thread Exposure via Diagnostics Channel CVE-2025-23083 nodejs: GOAWA...