CVE-2026-66918

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker...

CVE-2026-64246

A flaw was found in the Linux kernel's linkstation-poweroff module. An issue exists where a use-after-free vulnerability occurs due to incorrect handling of a node pointer in the linkstationpoweroffinit function. This flaw could lead to memory corruption, potentially causing system instability or...

Detect Node Exporter Metrics

Information Disclosure of Garbage Collection !/usr/bin/env python3 -- coding: utf-8 -- """Information Disclosure of Garbage Collection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Node Exporter Metrics',...

node-srv - Local File Inclusion Detection

node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a malicious user to read content of any file with known path. !/usr/bin/env python3 -- coding: utf-8 -- """node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a...

Omnia MPX 1.5.0+r1 - Local File Inclusion Detection

Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel. !/usr/bin/env python3 -- coding: utf-8 -- """Telos Alliance...

Puppet Node Manager - Unauthorized Access Detection

Pupper Node Manager is exposed to external users. !/usr/bin/env python3 -- coding: utf-8 -- """Pupper Node Manager is exposed to external users.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Puppet Node Manager -...

Node RED Dashboard <2.26.2 - Local File Inclusion Detection

NodeRED-Dashboard before 2.26.2 is vulnerable to local file inclusion because it allows uibase/js/..%2f directory traversal to read files. !/usr/bin/env python3 -- coding: utf-8 -- """NodeRED-Dashboard before 2.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Omnia MPX Node Login Panel - Detect

Omnia MPX Node login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Omnia MPX Node login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Omnia MPX Node Login Panel - Detect',...

Puppet Node Manager Detection

Detects Puppet Node Manager. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Puppet Node Manager.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Puppet Node Manager Detection', 'description': 'Detects Puppet No...

React / Node Dotenv File Exposure Detection

Checks for publicly readable .env / .env.local / .env.production files that often leak REACTAPP / VITE secrets on misconfigured SPA hosts. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed .env files on React / Vite / Node SPA deployments.""" from kittysploit import from...

Astro SSR - Open Redirect Detection

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. !/usr/bin/env python3...

Gradle Develocity Build Cache Node Login Panel - Detect

Gradle Develocity Build Cache Node login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gradle Develocity Build Cache Node login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Gradle Enterprise Build Cache Node Login Panel - Detect

Gradle Enterprise Build Cache Node login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gradle Enterprise Build Cache Node login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Node Shrinkwrap Exposure Detection

A file created by npm shrinkwrap. It is identical to package-lock.json. !/usr/bin/env python3 -- coding: utf-8 -- """A file created by npm shrinkwrap.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node Shrinkwrap...

Node ecstatic Directory Listing Detection

Directiory listing enabled in Node ecstatic. !/usr/bin/env python3 -- coding: utf-8 -- """Directiory listing enabled in Node ecstatic.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node ecstatic Directory Listing...

PNPM Lock Yaml File Disclosure Detection

The pnpm-lock.yaml file is similar to the package-lock.json file used by npm or the yarn.lock file used by Yarn. It serves as a lock file that ensures consistent and reproducible installations of dependencies across different environments. !/usr/bin/env python3 -- coding: utf-8 -- """The...

n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution Detection

n8n versions = 0.123.0 and = 0.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'n8n = 0.123.0 and = 0.123.0 and 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. A...

Node Express Status - Detect

Node Express Status is detected. !/usr/bin/env python3 -- coding: utf-8 -- """Node Express Status is detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node Express Status - Detect', 'description': 'Node Expre...

Node-RED Dashboard - Detect

Node-RED dashboard was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED dashboard was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node-RED Dashboard - Detect', 'description': 'Node-RED...

Node-RED - Unauthenticated Access Detection

Node-RED flow editor is accessible without authentication. Node-RED is a flow-based programming tool that can execute arbitrary system commands, read/write files, and make network requests. Unauthenticated access leads to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RE...