Jira - Incorrect Authorization Detection

Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. !/usr/bin/env...

Yii 2 < 2.0.38 - Remote Code Execution Detection

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. !/usr/bin/env python3 -- coding: utf-8 -- """Yii 2 yiisoft/yii2 before version 2.""" from kittysploit import from lib.protocols.http.httpclient import...

Pichome 2.1.0 - Arbitrary File Read Detection

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed t...

EvilGinx - Detect

Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies which in turn allows bypassing 2-factor authentication protection. !/usr/bin/env python3 -- coding: utf-8 -- """Evilginx2 is a man-in-the-middle attack framework used for phishing logi...

OpenBullet 2 - Panel Detection

Openbullet was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Openbullet was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenBullet 2 - Panel Detection', 'description': 'Openbullet was detected....

CVE-2026-59248

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

CVE-2026-8450 affecting package perl-HTTP-Daemon for versions less than 6.16-2

CVE-2026-8450 affecting package perl-HTTP-Daemon for versions less than 6.16-2. A patched version of the package is available...

TencentOS Server 2: xorg-x11-server (TSSA-2026:0764)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0764 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

CVE-2026-47219: Improper Input Validation

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2026-133 (ALASECS-2026-133)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-133 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3835 (ALAS-2026-3835)

The version of kernel installed on the remote host is prior to 4.14.355-284.741. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3835 advisory. In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK...

CVE-2026-6879: Inefficient Algorithmic Complexity

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-59248: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-127 (ALASKERNEL-5.10-2026-127)

The version of kernel installed on the remote host is prior to 5.10.260-259.1054. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2026-127 advisory. In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after...

DEBIAN-CVE-2025-63913

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function 2 or the 'Find and configure a matching counter' function of SBI PMU extension...

CVE-2025-63913

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function 2 or the 'Find and configure a matching counter' function of SBI PMU extension...

Malicious Package

Overview @yongot/canary-mcp-test-2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-59251

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

CVE-2025-63913

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function 2 or the 'Find and configure a matching counter' function of SBI PMU extension...

Fedora 43 : trafficserver (2026-ddaabe38ab)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ddaabe38ab advisory. Resolves CVE-2026-59173 - DoS vulnerability in HTTP/2 via stalled flow-control Additional Changes with Apache Traffic Server 9.2.14 12910 - Fix...