ReconTitan

A security-hardened platform for external reconnaissance, OSIN...

Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

Landray EKP - Path Traversal

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sysuicomponent/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to...

Exploit for Eval Injection in Langflow

CVE-2026-33017 — Langflow Unauthenticated RCE PoC 면책 조항...

Exploit for Authentication Bypass by Spoofing in Frangoteam Fuxa

CVE-2026-25938 - FUXA Unauthenticated RCE 1. What is FUXA?...

hyperlight-overlaybd-poc

hyperlight-overlaybd-poc Can the output of a sandboxed job...

📄 Apache Tomcat 11.0.2 Remote Code Execution

A proof of concept exploit for an unauthenticated remote code execution vulnerability in Apache Tomcat version 11.0.2. The vulnerability abuses partial PUT path equivalence to place a crafted Java serialized session file where a PersistentManager with FileStore can load it, resulting in unsafe Ja...

📄 Grafana 13.1.3 Authorization Bypass

A proof of concept exploit for an authorization bypass vulnerability in Grafana version 13.1.3. The vulnerability allows an authenticated Editor to delete a protected alert notification receiver despite lacking the permission required to modify its protected destination fields. The receivers upda...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-45186 DESCRIPTION: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized craft...

📄 Sonatype Nexus Repository 3.94.1 Repository Format Authorization Bypass

A proof of concept exploit for an authorization bypass vulnerability in Sonatype Nexus Repository version 3.94.1. The vulnerability exists because the coreuiRepository.create method performs authorization against the caller-controlled repository format field while constructing the repository usin...

📄 DCMTK 3.7.0 Path Traversal

dcmsend in DCMTK DICOM ToolKit version 3.7.0 is vulnerable to path traversal when it is instructed to read input files from a specially crafted DICOMDIR. This can lead to unauthorized disclosure of readable DICOM objects, including protected health information. Advisory ID: SYSS-2026-047 Product:...

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2024-34459 DESCRIPTION: An issue was discovered in xmllint from libxml2 before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a...

PYSEC-2026-3614 pytonapi has a Webhook Custom Path Authentication Bypass

Webhook Custom Path Authentication Bypass in pytonapi Summary TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths...

📄 osTicket 1.18.3 Authentication Bypass Account Takeover

A proof of concept exploit for an osTicket version 1.18.3 authentication bypass account takeover vulnerability. osTicket versions 1.17.8 through 1.18.3 contain a flaw in PasswordResetTokenBackend::signOn where the password reset expiration check is incorrectly guarded by a short-circuiting logica...

OESA-2026-3204 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devmkmemdup in rtwsetsupportedband Simplify the code by using device managed memory allocations. This also fixes a memory leak in rtwregisterhw...

GHSA-G956-2F74-RMV7 hashi-vault-js has a path traversal and query parameter injection

Summary The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject...

hashi-vault-js has a path traversal and query parameter injection

Summary The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 vivo PD2425 Exploit Adaptation Project A porti...

Toy Ghouls’ new toy: the GenieLocker ransomware

Introduction The new GenieLocker ransomware family has been active since March 2026. It has been used in attacks against organizations in the Russian Federation, primarily in the manufacturing sector, and attributed to the Toy Ghouls group by open-source intelligence link in Russian. The Toy...

pytonapi has a Webhook Custom Path Authentication Bypass

Webhook Custom Path Authentication Bypass in pytonapi Summary TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths...