CVE-2026-32646

CVE-2026-32646: Autenticazione mancante sull'endpoint amministrativo di gestione dispositivi Avviso Campo| Valore ---|--- CVE| CVE-2026-32646 ICSA| ICSA-26-055-03 Aggiornamento A CVSS 3.1| 7.5 Alto Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE| CWE-306 Autenticazione mancante per...

thingsboard

Piattaforma IoT open-source per raccolta, elaborazione, visualizzazione e gestione dei dispositivi. 💡 Inizia • 🌐 Sito web • 📚 Documentazione • 📔 Blog • 🔗 LinkedIn 🚀 Opzioni di installazione Installa ThingsBoard on-premises o usa ThingsBoard Cloud. 💡 Iniziare con ThingsBoard Dai un'occhiata alla...

adbsploit

ADBSploit Uno strumento basato su Python per sfruttare e gestire dispositivi Android tramite ADB Attualmente in sviluppo Screenrecord Stream Screenrecord Estrai Contatti Estrai SMS Estrai Chat App di Messaggistica WhatsApp/Telegram/Line Installa Backdoor E altro ancora... Installazione...

adbsploit

ADBSploit A python based tool for exploiting and managing Android devices via ADB Currently on development Screenrecord Stream Screenrecord Extract Contacts Extract SMS Extract Messasing App Chats WhatsApp/Telegram/Line Install Backdoor And more... Installation root@kitploit: First Download or...

zafrida-ui

Chinesisch | English ZAFrida UI - PyCharm Frida Plugin Aktuelle Version: 0.3.6 Projektvorstellung Speziell für PyCharm/IntelliJ entwickeltes grafisches Frida-Tool ZAFrida UI ist ein in PyCharm und JetBrains-IDE integriertes grafisches Frida-Plugin. Es löst die Probleme der umständlichen...

simvyn

simvyn Strumento mobile universale — controlla simulatori iOS, emulatori Android e dispositivi reali da un'unica dashboard e CLI Avvio rapidobash npx simvyn root@kitploit: Avvia il server locale, apre la dashboard web nel tuo browser e scopre automaticamente tutti i simulatori, emulatori e...

YeaLink DM 3.6.0.20 - Remote Command Injection

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. id: CVE-2021-27561 info: name: YeaLink DM 3.6.0.20 - Remote Command Injection author: shifacyclewala,hackergautam severity: critical description: Yealink...

CVE-2026-22011-iOS-MDM-Profile-Delivery-over-HTTP

CVE-2026-22011 – Consegna del profilo MDM iOS su HTTP Codice del programma Server MDM Python Flask root@kitploit: mdmserver.py - Serves enrollment profile over plain HTTP from flask import Flask, sendfile app = Flaskname @app.route'/enroll.mobileconfig' def serveprofile: Vulnerability: profile...

frida-ui

Frida UI Eine moderne, leichtgewichtige, webbasierte Benutzeroberfläche für Frida, entwickelt für Android-Applikations-Penetrationstests. Sie ermöglicht die Interaktion mit Geräten, Prozessen und Skripten direkt aus dem Browser. Schnellstart root@kitploit: Installation mit uv empfohlen oder...

CVE-2026-76257

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access...

CVE-2026-76257

CVE-2026-76257 is a missing authorization vulnerability in Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Splunk Secure Gateway (below 3.10.10, 3.9.24, 3.8.71). The root cause is that REST API endpoints for deployment bundle, SAML setup, and companion app workflows do not enforce Sp...

CVE-2026-74472 ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned devinfo fields in ublkctrladddev ublkctrladddev memcpys the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields the driver owns, but misses -state and -ublksrvpid. A device added wit...

CVE-2026-49481

UpSnap (wake on LAN web app) before version 5.4.0 is affected by an authenticated OS command injection in device management. User-controlled ip/mac values can be interpolated into wake_cmd/shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, enablin...

PT-2026-71367

Name of the Vulnerable Software and Affected Versions UpSnap versions prior to 5.4.0 Description An OS command injection flaw exists in the device management functionality. This occurs due to unsafe shell command template interpolation using the ip and mac fields. An authenticated low-privileged...

CVE-2026-68392

A flaw was found in the Linux kernel's Bluetooth management subsystem. This vulnerability occurs due to incorrect locking when handling memory pointers during device unpairing and disconnection. An attacker could exploit this to trigger a Use-After-Free UAF condition, which is a type of memory...

UBUNTU-CVE-2026-68423

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroy mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat after that leads to a use-after-free. Fix it by moving mtdvirtconcatputmtddevices...

CVE-2026-68333 dpaa2-switch: put MAC endpoint device on disconnect

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: put MAC endpoint device on disconnect fslmcgetendpoint returns the MAC endpoint device with a reference taken through devicefindchild. The switch port connect path stores that device in mac-mcdev and keeps it for th...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: sbs-battery: Fixed a use-after-free in powersupplychanged. By using the devm variant to request the IRQ before using the devm variant to allocate/register the powersupply handle, it is possible that the powersupply...

CVE-2026-9030 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...

CVE-2026-62433

The CVE-2026-62433 issue relates to the Xen DM_OP handling path. Connected advisories document insufficient buffer checks in DM_OP hypercalls, allowing operations to proceed without validating the caller-supplied buffer count. This can enable reading of Xen stack contents and potentially leak dat...