GO-2024-3208 vulnerabilities

Vulnerabilities for packages: hubble-ui, hubble-ui-backend-fips...

GO-2024-2922 vulnerabilities

Vulnerabilities for packages: hubble-ui, hubble-fips, hubble-ui-backend-fips, hubble...

GO-2024-3072 vulnerabilities

Vulnerabilities for packages: hubble-ui, hubble-ui-backend-fips, hubble...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: kots, envoy-gateway-fips, kine, envoy-gateway, commercial-expanso-edge, k3s, commercial-chainloop-backend, spire-server, commercial-grafana...

ReconTitan

A security-hardened platform for external reconnaissance, OSIN...

dirsearch v0.5.0

dirsearch - Web Path Discovery An advanced web path brute-forcer dirsearch is being actively developed by @maurosoria and @shelld3v. Join the Discord server to communicate with the team. Quick Start dirsearch requires Python 3.11 or higher. root@kitploit: git clone...

PT-2026-72056

Name of the Vulnerable Software and Affected Versions Tenable Security Center affected versions not specified Description A command injection flaw allows an authenticated administrator to execute arbitrary commands on the underlying operating system. This occurs when the administrator modifies...

CVE-2026-71570: Improper Access Control

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...

CVE-2026-71571: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

CVE-2026-19838: Authorization Bypass Through User-Controlled Key

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-19836: Authorization Bypass Through User-Controlled Key

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...

PT-2026-72049

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-57469: Cross-Site Request Forgery (CSRF)

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

PT-2026-72116

Name of the Vulnerable Software and Affected Versions icagenda.com versions prior to 2.0.0 and 4.0.11 Description An Access Control List ACL bypass exists where a backend operator with access restricted to the com icagenda component can enumerate Joomla user profiles. ACL is a mechanism used to...

PT-2026-72117

Name of the Vulnerable Software and Affected Versions iCagenda versions prior to 2.0.0-4.0.11 Description Authenticated backend operators with permissions to access the extension can perform SQL injection. This occurs due to an unescaped numeric filter, allowing the injection of malicious SQL...

PT-2026-72072

Name of the Vulnerable Software and Affected Versions Capstone versions prior to 6.0.0-Alpha9 Description The public cs insn name API forwards caller-supplied instruction IDs directly to the selected architecture backend. In the M68K and RISCV backends, missing or incomplete bounds checks allow a...

PT-2026-76566

Name of the Vulnerable Software and Affected Versions fabric-ca affected versions not specified Description When configured with an LDAP backend, the software fails to properly escape the username obtained from HTTP Basic authentication before including it in an LDAP uid search filter. This allow...

CVE-2026-73666

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

CVE-2026-73666

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

EUVD-2026-58543

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...