TencentOS Server 4: ceph (TSSA-2026:1003)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1003 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

PT-2026-93355

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-76867 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routingtabaddcgi, routingtablelistshowcgi, routepolicyaddcgi, and routepolicyparameshowcgi. Attackers can inject persistent script payloads...

CVE-2026-76856 Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

redis-exploitation

redis-exploitation CONFIG SET Solo con fines educativos Compilar root@kitploit: $ docker build -t victim . Ejecutar root@kitploit: $ docker run -d --name victim victim Ataque root@kitploit: $ docker exec -it victim bash root@kitploit: root@34ea33cb2eb2 / ls /var/spool/cron/ root@34ea33cb2eb2 /...

CVE-2025-49132_poc

CVE-2025-49132poc 使用示例 1. 扫描单个目标 ： root@kitploit: python3 CVE-2025-49132poc.py -u http://pterodactyl.example.com 2. 扫描目标列表 ： root@kitploit: python3 CVE-2025-49132poc.py -f 目标列表.txt 3. 保存扫描结果 ： root@kitploit: python3 CVE-2025-49132poc.py -f 目标列表.txt -o 扫描结果.txt 输出示例： 存在漏洞时 ： root@kitploit: + 存在漏洞:...

Security Bulletin: IBM Terracotta is affected by Logback vulnerabilities that could allow attackers to exploit conditional configuration file processing

Summary IBM Terracotta uses Logback for logging purposes within the product. Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit...

Malicious code in bender-rspack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4 package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL, embedding $whoami, $pwd, and $hostname as...

MAL-2026-16221 Malicious code in bender-rspack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4 package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL, embedding $whoami, $pwd, and $hostname as...

CVE-2026-55692 EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,...

EUVD-2026-78797

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91940 crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91932 Flowise before 3.1.4 Remote Code Execution via cwd Parameter

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working...

CVE-2026-90818

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

EUVD-2026-77640

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-57128

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...