michaelis labs

offensive security, real-world impact

Tag: cve

  • CVE-2026-27626: OliveTin

    —

    by

    michaelis
    in

    OliveTin is a tool that lets end-users run shell commands through a web interface. It has two serious bugs (tracked together as CVE-2026-27626) that let an attacker run any command they want on the server, without even needing to log in. Password fields: The app doesn’t clean up what users type into “password” fields before…

  • CVE-2025-55319: Agentic AI in VS Code – RCE

    —

    by

    michaelis
    in ,

    VS Code has a built-in AI feature (called “Agentic AI”) that can help you write code. This vulnerability is a “command injection” flaw. That’s a fancy way of saying: a hacker can trick the AI into running harmful commands on your computer, as if the hacker was sitting at your keyboard. Uploading a malicious .vsix…

  • CVE 2025-24071

    —

    by

    michaelis
    in ,

    Server-side ZIP extraction leads to NTLM hash leakage. This specific vulnerability exploits NTLM Hash Leak via RAR/ZIP extraction and .library-ms file.