ROOT-OS-DEBIAN-13-CVE-2026-8924 CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-10966 CVE-2025-10966 in curl - Patched by Root

Root has patched CVE-2025-10966 in the curl package for Root:Debian:13. Multiple fixed versions available...

CLSA-2026-1788762932 TuxCare security update for org.bouncycastle (4 CVEs)

TuxCare rebuilt 16 org.bouncycastle packages to address 4 CVEs. Fixed in 1.76-tuxcare.4...

Emby < 4.5.0 - Server Server-Side Request Forgery

Emby Server before 4.5.0 allows server-side request forgery SSRF via the Items/RemoteSearch/Image ImageURL parameter. id: CVE-2020-26948 info: name: Emby 4.5.0 - Server Server-Side Request Forgery author: dwisiswant0 severity: critical description: | Emby Server before 4.5.0 allows server-side...

Apache Struts2 S2-062 - Remote Code Execution

Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. id: CVE-2021-31805 info: name...

Oracle WebLogic Server Local File Inclusion

An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can...

WP Time Capsule Plugin - Remote Code Execution

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticat...

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting

Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. id: CVE-2021-41349 info: name: Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting author: rootxharsh,iamnoooob severity: medium description: Microsoft Exchange...

RealTek Jungle SDK - Arbitrary Command Injection

There is a command injection vulnerability on the "formWsc" page of the management interface. Successful exploitation of this vulnerability could lead to remote code execution and compromise of the affected system. id: CVE-2021-35395 info: name: RealTek Jungle SDK - Arbitrary Command Injection...

WordPress File Upload <= 4.24.11 - Arbitrary File Read

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitatio...

CVE-2025-55423-analysis-and-reproduction

This repository does not have a README...

CVE-2026-20245

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual environment...

CVE-2026-50507

cve-id ⚡ Uso Simple Use este proyecto solo en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Configuraciones de laboratorio aisladas Entornos de pruebas de penetración autorizados Configuración de ejemplo: root@kitploit: git clone cd Project use python follow...

CVE-2025-41242

⚠️ Aviso Legal e Investigación de Seguridad 📌 Propósito de Este Repositorio Este repositorio se proporciona estrictamente con fines educativos, académicos y de investigación autorizada en ciberseguridad. Está destinado a apoyar la comprensión de: Vulnerabilidades de seguridad y conceptos de...

CVE-2026-86268

creationtimestamp| type| source ---|---|--- 2026-09-07 05:47:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2zui7f45fntkc 2026-09-07 08:15:10+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86268...

BIT-KIBANA-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

CVE-2025-15467

CVE-2025-15467 discovery tool powershell...

ContextHound

ContextHound Static analysis tool that scans your codebase for LLM prompt-injection and multimodal security vulnerabilities. Runs offline, no API calls required. The ContextHound ecosystem ContextHound is available across your entire development and browsing workflow:...

BIT-ELK-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

CVE-2026-8732

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Example usage: root@kitploit: Install dependencies Run the...