CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

PoC-for-CVE-2025-9074

CVE-2025-9074 - PoC de Acesso Não Autenticado à API do Docker 📌 Visão Geral Este repositório fornece um exploit de Prova de Conceito PoC para CVE-2025-9074 , que envolve a exposição não autenticada da API do Docker Engine na porta TCP 2375. Um atacante que consiga acessar essa API exposta pode:...

EUVD-2026-64763

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri , a URI parser for Node.js, suffers from double percent-decoding of the hostname: it decodes percent escapes during parsing and decodes them again during authority recomposition. This violates RFC 3986 §2.4 (an implementation must not decode the same string more than once) and allows a s...

CVE-2026-75931

fast-uri , a URI parser for the Node.js ecosystem, is vulnerable to host confusion and policy bypass (CVSS 3.1: 7.5 HIGH ). The root cause is that the host is canonicalized to ASCII form only when the input carries an explicit scheme; scheme-relative references (host preceded by //) are returned ...

CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

EUVD-2026-64758

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

CVE-2026-75931

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

EUVD-2026-64757

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897

A path traversal vulnerability in LXD 's instance template processing allows an attacker with container edit permissions—or any user launching a crafted image—to overwrite arbitrary host files as root , achieving host-level code execution. The root cause is a discrepancy between path validation (...

SeekYou

Apoie o Desenvolvimento Se este projeto ajuda o seu trabalho, apoie a manutenção contínua e novas funcionalidades. Carteira de Doação ETH 0x11282eE5726B3370c8B480e321b3B2aA13686582 Escaneie o código QR ou copie o endereço da carteira acima. SeekYou Inteligência unificada de hosts em 15 fontes —...

powershell-reverse-tcp

PowerShell Reverse TCP PowerShell scripts for communicating with a remote host. Remote host will have a full control over the client and all the underlying system commands. Check shells based on: Invoke-Expression PowerShell command here, process pipes here. Tested with PowerShell v5.1.19041.2673...

NovaHypervisor

NovaHypervisor Descrição O NovaHypervisor é um hipervisor defensivo baseado em host Intel x64. O objetivo deste projeto é proteger contra ataques no nível do kernel seja por meio de Bring Your Own Vulnerable Driver BYOVD ou outros meios resguardando produtos de defesa Antivírus / Proteção de...

hakoriginfinder

hakoriginfinder Tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies. How does it work? This tool will first make a HTTP request to the hostname/URL that you provide and store the response, then it will make a request to every IP address...

UPnPHostFileRead

Descrição Exploit PoC de leitura arbitrária de arquivos locais para o serviço Windows UPnP Device Host. Lê um arquivo arbitrário no contexto de LOCAL SERVICE. Testado no Windows 11 Pro build 26200.8457. Reportado à Microsoft. Avaliado como "não é uma vulnerabilidade". Como Compilar 1. Clone o...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC heap out-of-bounds Prova de conceito para uma leitura e escrita fora dos limites do heap no tratamento da alteração de estado de página PSC do SEV-SNP do KVM. Um convidado SEV-SNP malicioso faz com que o kernel anfitrião percorra um array de entradas PSC além do...

sshprank

Description A fast SSH mass-scanner, login cracker, banner grabber and password auth checker tool using the python-masscan and shodan module. Usage root@kitploit: hacker@blackarch $ sshprank -H / / / / / / / / / / / / /// | / / / // / / / // / / / / , opts | mode options -h - single host, cidr,...