POC_CVE-2025-29943_Write-what-where-Condition

StackWarp: CVE-2025-29943 PoC AMD 프로세서의 StackWarp 하드웨어 취약점CVE-2025-29943에 대한 개념 증명PoC입니다. 이 결함으로 인해 호스트하이퍼바이저에서 관리자 권한을 가진 공격자가 CPU 파이프라인 구성을 조작하여 SEV-SNP 게스트 가상 머신 내부의 스택 포인터를 손상시킬 수 있으며, 이로 인해 권한 상승 및 임의 코드 실행이 발생합니다. 📋 취약점 요약 ID: CVE-2025-29943 제품: AMD EPYC 프로세서7003, 8004, 9004, 9005 시리즈 및...

EUVD-2026-90645

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

Vulnerability hidden in Apple CoreGraphics

Apple has identified a vulnerability in CoreGraphics on iOS, iPadOS, and macOS. This vulnerability involves an out-of-bounds write operation within the CoreGraphics component. An attacker can exploit this vulnerability by processing specially crafted files, which may lead to the execution of...

cve-2026-80428-ctf

CVE-2026-80428 CTF Training Lab Educational emulator of the vulnerability mechanics described in CVE-2026-80428 CWE-502: Deserialization of Untrusted Data. This is not a real ILIAS installation and not a weaponized exploit package. It is a fully containerized, isolated laboratory for students,...

CVE-2025-65346

CVE-2025-65346 – laravel-file-manager v3.3.1의 UnZip 함수에서 발생하는 인증된 경로 탐색으로 인한 임의 파일 쓰기 🧭 개요 영향을 받는 애플리케이션의 unzip/extract 기능에서 발생하는 경로 탐색 취약점으로 인해 공격자는 압축 해제 중 임의의 파일 시스템 위치에 파일을 쓸 수 있습니다. 추출 루틴이 ZIP 항목 내부의 대상 경로를 검증하지 않기 때문에, 공격자는 경로 탐색 시퀀스예: ../../routes 또는 절대 경로가 포함된 ZIP 아카이브를 조작할 수 있습니다. 애플리케이션...

BIT-RABBITMQ-2026-67224 RabbitMQ: Admin path-traversal write via trace name

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...

Security Bulletin: Due to use of VMware ESXi and vCenter, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Vulnerabilities in VMware ESXi and vCenter affect IBM Cloud Pak System. IBM Cloud Pak System version 2.3.6.2 has addressed these vulnerabilities. Cloud Pak Sytem has updated Platform System Manager PSM and workload nodes to VMware ESXi 83U3k and VMware vCenter to VCSA 83U3k. Vulnerability...

SUSE-SU-2026:4409-1 Security update for gimp

This update for gimp fixes the following issues: - CVE-2026-18301: Vulnerability Report at readchanneldata bsc1276230. - CVE-2026-18302: TIF File Parsing Heap-based Buffer Overflow bsc1276231. - CVE-2026-18303: TIF File Parsing Stack-based Buffer Overflow bsc1276232. - CVE-2026-18304: TIF File...

thrift: thrift: Denial of Service via integer underflow in THeaderTransport

A flaw was found in Apache Thrift. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted network traffic to an affected application. Due to an integer underflow in the 32-bit C++ THeaderTransport component, processing this malformed data triggers an...

CVE-2025-4517-poc

CVE-2025-4517 PoC – Python tarfile 경로 탐색을 통한 임의 파일 쓰기 CVE-2025-4517 CVSS 9.4 – Critical Python의 tarfile 모듈에서 TarFile.extractall 또는 TarFile.extract를 filter="data" 또는 filter="tar"와 함께 사용할 때 추출 디렉터리 외부에 임의의 파일을 쓸 수 있게 하는 취약점입니다. 영향받는 버전 : filter="data" 또는 filter="tar"를 명시적으로 사용하는 Python 3.12+ Python...

CVE-2026-43284-dirtyfrag-detection

DirtyFrag CVE-2026-43284 PoC 검증 및 auditd 탐지 범위: CVE-2026-43284 와 관련된 XFRM/ESP 경로에 초점을 맞춘 Linux 로컬 권한 상승LPE 검증. 이 저장소에는 공개 DirtyFrag PoC에 대한 통제된 실험실 검증 결과인 영문 보고서와 증거 자료가 포함되어 있습니다. 초점은 악용 가이드를 제공하는 것이 아니라 Linux 감사 로그에서 무엇이 관찰되었는지, 그리고 그러한 이벤트를 실용적인 SOC 탐지 로직으로 어떻게 변환할 수 있는지 문서화하는 데 있습니다. 전체 PDF...

CVE-2026-43284-DIRTY-FRAG-

CVE-2026-43284-DIRTY-FRAG- Linux 커널의 CVE-2026-43284 Dirty Frag 로컬 권한 상승 취약점에 대한 상세 기술 분석. CVE-2026-43284 일반적으로 Dirty Frag 취약점 제품군의 일부로 언급됨는 Linux 커널의 치명적인 로컬 권한 상승LPE 취약점입니다. 이는 xfrm ESP Encapsulating Security Payload 입력 서브시스템 내의 논리 결함에서 비롯됩니다. 이 버그를 통해 로컬의 비특권 공격자가 일반적인 Copy-on-Write CoW 보호를 우회하...

Chromium CVE-2026-87438: Out of bounds write in WebGL

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-93495

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the ' Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information...

CVE-2026-93495

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the ' Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information...

CVE-2026-93495

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the ' Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information...

CVE-2026-93495

A vulnerability exists in certain ASUS motherboards due to improper initialization . This flaw allows a physically proximate user to read or write arbitrary memory by inserting a specially crafted device . The vulnerability has a high severity score of 7.0 (CVSS 4.0) and requires physical access....

MGASA-2026-0463 Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...