CVE-2024-38355-PoC

CVE-2024-38355 Demo Socket.IO Crash This project is a Proof of Concept demonstrating CVE-2024-38355 , a denial-of-service vulnerability in socket.io. The project was created for educational purposes to show the attack mechanism and how to protect applications. About the Vulnerability CVE-2024-383...

Linux-Kernel-Dirty-Pipe-Exploitation-Logic-Bug-

Linux Kernel Dirty Pipe Exploitation Logic Bug by: Antonius w1sdom https://www.bluedragonsec.com https://github.com/bluedragonsecurity Dirty Pipe CVE-2022-0847 is one of the most significant security vulnerabilities in Linux Kernel 5.8 – 5.15.24, discovered by Max Kellermann in 2022. This...

CLEANSTART-2026-BZ34965 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

awesome-web3-security

awesome-web3-security A curated list of Web3 Security materials and resources for Pentesters and Bug Hunters. If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below, perfect works of ar...

EUVD-2026-107656

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining...

EUVD-2026-107653

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster...

EUVD-2026-107659

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "scadmin" Splunk Secure Gateway role could read mobile alert notification data for...

EUVD-2026-107662

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer REST API endpoint for lookup table...

CVE-2024-21413

CVE-2024-21413 - Expect Script POC Microsoft Outlook Leak credentials & Remote Code Execution Vulnerability when chained with CVE-2023-21716 through the preview panel CVSS:3.1 9.8 / 8.5 Outlook should warm you about the risk on opening an external link = but this is not the case! usage:...

web3-decoder

Web3 Decoder Web3 Decoder is a Burp Suite Extension designed for analyzing blockchain operations and smart contract interactions. It processes JSON-RPC calls to Ethereum and compatible networks including Polygon, Arbitrum, BSC, and others Block explorers API Keys Most block explorers supported,...

CVE-2025-1974

cve-2025-1974-win11-attack-defense-lab Windows 11-first educational repository for studying CVE-2025-1974 in a safe, non-weaponized ATTACK + DEFENSE lab. The project is designed for university coursework, team demos, and report-ready screenshots. It emphasizes clean-room implementation, local-onl...

efcf-framework

EF/CF - the Extremely Fast ethereum smart Contract Fuzzer EF/CF is a new approach to smart contract fuzzing: instead of using a new custom built fuzzer, it repurposes existing fuzzing infrastructure of C/C++ code to smart contracts. Currently, AFL++ is the primarily supported fuzzer, although the...

CVE-2026-12960

CVE-2026-12960 Improper Export of Android Application Components in the ASUS Router App A component bundled in the ASUS Router Android app com.asus.aihome was declared android:exported="true" with no android:permission. Any other app on the same device, holding zero permissions, could send it a...

CVE-2018-14324-Exploit

Hacking Eclipse GlassFish - CVE-2018-14324 The description of CVE-2018-14324 does not fully explain the impact of this vulnerability. TLDR you have access to Java Management Extensions JMX via hardcoded admin:admin creds. While impact is listed as " potentially sensitive information, perform...

red-clippy

Red Clippy Your agent tests. Red Clippy keeps the record. Open-source pentest management built to be operated by an AI agent. Connect it to Claude Code over MCP and it runs the engagement alongside you: scope and assets, recon observations, methodology coverage, and findings with CVSS and evidenc...

CVE-2026-10520-10523

CVE-2026-10520, CVE-2026-10523 Ivanti Sentry ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Creat...

glycin-loaders security update

An update is available for glycin-loaders. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Sandboxed and extendable image decoding. Security Fixes: librsvg:...

RLSA-2026:86331 Important: glycin-loaders security update

Sandboxed and extendable image decoding. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the...

RLSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

lrzsz security, bug fix, and enhancement update

An update is available for lrzsz. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmode...