YellowKey-BitLocker-Bypass-CVE-2026-45585-Detect-Fix-Automatically-via-Microsoft-Intune

Questo repository non contiene un README...

CVE-2026-2256-

CVE-2026-2256- CVE-2026-2256 diagramma...

CVE-2026-31431-Copy-Fail

CVE-2026-31431 Copy Fail Vorkompilierter Exploit für CVE-2026-31431 Copy Fail. Originalquellcode von tgies/copy-fail-c, mit hinzugefügtem Build-Ziel für i386 x8632. Entdeckung der Schwachstelle und ursprünglicher PoC von theori-io/copy-fail-CVE-2026-31431. Kanonischer Bericht: copy.fail. Build...

CVE-2026-20700-POC-that-ll-never-work

Questo repository non contiene un README...

CVE-2026-20262

cve-id ⚡ Utilizzo Semplice Utilizza questo progetto solo in ambienti sicuri e autorizzati, come: Macchine virtuali locali Container Docker Setup di laboratorio isolati Ambienti di test di penetrazione autorizzati Esempio di configurazione: root@kitploit: git clone cd Project use python follow bel...

copyfail-alpine

Questa è una versione più minimale del port di Copy Fail LPE CVE-2026-31431 che modifica i primi byte di /etc/passwd in modo che su-ing verso root non richieda password. Questo riduce la dimensione totale dell'exploit originale e lo rende più portabile. Distribuzioni come Alpine usano busybox/mus...

CVE-2026-42271

cve-id ⚡ Utilizzo Semplice Usa questo progetto solo in ambienti sicuri e autorizzati, come: Macchine virtuali locali Contenitori Docker Setup di laboratorio isolati Ambienti di penetration testing autorizzati Esempio di configurazione: root@kitploit: git clone cd Project use python follow below...

CVE-2026-0745

⚠️ Ricerca sulla Sicurezza e Disclaimer Legale - CVE-2026-0745 📌 Scopo di Questo Repository Questo repository è fornito esclusivamente per scopi educativi, accademici e di ricerca autorizzata in ambito di cybersecurity. È pensato per favorire la comprensione di: Concetti di vulnerabilità di...

merge-authz-test

merge-authz-test authz-Test CVE-2026-1999 Geschwister...

CVE-2026-20245

cve-id ⚡ Utilizzo Semplice Utilizza questo progetto solo in ambienti sicuri e autorizzati, come: Macchine virtuali locali Container Docker Configurazioni di laboratorio isolate Ambienti di test di penetrazione autorizzati Configurazione di esempio: root@kitploit: git clone cd Project use python...

UniFi OS Server - Command Injection

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. id: CVE-2026-34910 info: name: UniFi OS Server - Command Injection author: Kazgangap severity: critical description: | A malicious actor...

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

Ivanti Endpoint Manager - Authentication Bypass

Ivanti Endpoint Manager 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges. id: CVE-2026-1603 info: name: Ivanti Endpoint Manager - Authentication Bypass author:...

WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'armdirectorypagingaction' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of...

XWiki Platform Distribution Flavor Main - Cross-Site Scripting

XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting XSS due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in t...

Gitea Container Registry - Unauthorized Private Image Access

Gitea = 1.26.2. As a temporary workaround, set REQUIRESIGNINVIEW=true in gitea app.ini, though this blocks all anonymous access including public repos. reference: - https://blog.gitea.com/release-of-1.26.2/ - https://github.com/go-gitea/gitea/pull/37290 -...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

HT Mega < 3.0.7 - Sensitive Information Disclosure

The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation. id: CVE-2026-4106 info: name: HT Mega 3.0.7 - Sensitive Information Disclosure author: EFETR severity: high description: |...

Open WebUI < 0.9.5 - Information Disclosure

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...