13487 matches found
VulnCheck KEV: CVE-2026-53576
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...
nikto v2.6.1
nikto Nikto web server scanner - https://cirt.net/Nikto2 Full documentation - https://github.com/sullo/nikto/wiki Run normally: root@kitploit: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.co...
CVE-2026-52855
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...
Exploit for CVE-2026-66066
KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...
CVE-2026-16503
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...
CVE-2026-52855
Wings (Pterodactyl server control plane) contains a vulnerability in egg configuration-file templating prior to v1.12.3: {{config.}} placeholders can reveal sensitive daemon config values ({{config.token}}, {{config.token_id}}, {{config.docker.registries}}) to a low-privilege user. The issue aris...
CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...
CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...
EUVD-2026-51547
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...
CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...
CVE-2026-16503
The VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432 ) using the default password "postgres" . Because Docker manages its own iptables rules, this configuration bypasses standard host UFW firewall protections. A remote attacker ca...
Sirius v1.1.0
Sirius Scan Sirius is an open-source vulnerability scanner with automated discovery, CVE-based detection, and a modern web UI. Clone, run four commands, start scanning. Quick Start root@kitploit: git clone https://github.com/SiriusScan/Sirius.git cd Sirius docker compose -f...
CVE-2026-16503: Initialization of a Resource with an Insecure Default
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...
PT-2026-66782
Name of the Vulnerable Software and Affected Versions Wings versions prior to 1.12.3 Description Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When rendering configuration files, any config. placeholder in a replacement value is resolved against th...
PT-2026-66762
Name of the Vulnerable Software and Affected Versions VPS.org one-click Supabase template affected versions not specified Description Deployment of the template installs a PostgreSQL instance published on all interfaces 0.0.0.0:5432 using a default database password set to postgres. This exposure...
CVE-2026-67208
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...
CVE-2026-67208 Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...
EUVD-2026-51278
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...
CVE-2026-67208
CVE-2026-67208 – Juggle 1.6.0 exposes an unauthenticated remote code execution via the exposed H2 database web console. An attacker can reach the unprotected /h2-console endpoint, authenticate with default shipped credentials, and use the H2 CREATE ALIAS Runtime.exec() technique to execute arbitr...
SUSE CVE-2026-39386
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control of the entire Neko instance member management, room settings, broadcast control, session...