PT-2026-107839

Name of the Vulnerable Software and Affected Versions SecuShare Pro version 4 Description SecuShare Pro contains an OS Command Injection flaw that allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the server. OS Command Injection is a flaw where ...

PT-2026-108055

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to web and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...

PT-2026-108315

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An HTTP server handler improperly continues to read and serve requests from a connection after sending a 2xx response to an HTTP/1 CONNECT request without...

PT-2026-108312

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The HTTP/2 server incorrectly refunds connection-level flow control twice for the same data. This occurs when a client resets a stream, refunding data for the...

Zabbix Server 7.0.x < 7.0.29 / 7.4.x < 7.4.13 Authentication Bypass (ZBX-28196)

The version of Zabbix Server installed on the remote host is 7.0.x prior to 7.0.29, or 7.4.x prior to 7.4.13. It is, therefore, affected by an authentication bypass vulnerability: - Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate...

CVE-2025-32433

CVE-2025-32433 Una vulnerabilidad crítica en el servidor SSH de Erlang/OTP permite la ejecución remota de código RCE sin autenticación. La falla existe en el mecanismo de manejo de mensajes del protocolo SSH, permitiendo a los atacantes ejecutar comandos arbitrarios sin requerir credenciales de...

[slackware-security] xorg-server

New xorg-server packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/xorg-server-1.20.14-i586-22slack15.0.txz: Rebuilt. This update fixes security issues: XKB SetGeometry TextDoodad Double Free...

CVE-2024-40725

Herramienta de Detección de HTTP Request Smuggling Este repositorio contiene una herramienta basada en Python para detectar vulnerabilidades de HTTP Request Smuggling, dirigida específicamente a CVE-2024-40725. La herramienta intenta explotar esta vulnerabilidad en el servidor HTTP Apache enviand...

confusploit

Este script encuentra servidores vulnerables a CVE-2022-26134 y puede usarse junto con SHODAN CLI y Bash Scripting One-Liner Úselo solo con fines legales y educativos Ejecución remota de código sin autenticación previa en Confluence mediante inyección OGNL CVE-2022-26134 El 2 de junio de 2022,...

CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-

🧪 STEP 1: Demo vulnerable web-app LAB We create logic similar to CVE-2025-55182 unsafe server-side execution. 📁 vulnapp/app.py from flask import Flask, request import subprocess app = Flaskname @app.route"/render", methods="POST" def render: data = request.json.get"component" ❌ VULNERABLE: user...

ms09-050-CVE-2009-3103-exploit

Contenedor de Exploit MS09-050 SMBv2 Configuración de una sola línea para la explotación de MS09-050 CVE-2009-3103. Sin complicaciones, sin depuración, simplemente funciona. ¿Por qué? La mayoría de los scripts de MS09-050 que circulan requieren inyección manual de shellcode, tienen problemas de...

CVE-2021-41773-Apache-Path-Traversal-Lab

Apache CVE-2021-41773 Security Lab A controlled cybersecurity lab developed during my internship at ITSOLERA PVT LTD to study and demonstrate CVE-2021-41773 , a path traversal and potential remote code execution vulnerability affecting Apache HTTP Server 2.4.49. 📌 Project Overview This project...

CVE-2025-55182

CVE-2025-55182 - React Server Components RCE Exploit Python CLI exploit for CVE-2025-55182, a critical RCE vulnerability in React Server Components via react-server-dom-webpack. Based on: ejpir/CVE-2025-55182-poc Quick Start Docker Testing Unpack src.zip zip -r src.zip src Build and run vulnerabl...

Mobile-Drop-Device-SOC-Detection

🛡️ Project Phantom: Simulazione di Rilevamento SOC di un Dispositivo "Drop" Mobile Questo progetto dimostra un workshop di laboratorio SOC end-to-end che simula come un dispositivo Android senza root non autorizzato Casper Via S, utilizzato come "Drop Device" all'interno di una rete interna, viene...

Security Bulletin: Vault PKI ACME Issues Certificate With Unvalidated SANs

Summary Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabli...

CVE-2026-105818

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

cve-2021-41773-exploration

Resumen CVE-2021-41773 es una vulnerabilidad de path traversal descubierta en Apache HTTP Server 2.4.49 en octubre de 2021. La causa raíz fue una falla en la normalización adecuada de las secuencias de puntos terminadas en la URL antes de verificar si la ruta solicitada permanecía dentro de la ra...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities

Summary Vault’s PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabli...

CVE-2026-76286

In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...