CVE-2025-14857-MongoBleed

CVE-2025-14847 MongoBleed - Рабочий PoC Эксплуатация утечки памяти в MongoDB - Симулированная атака R6 Полноценное доказательство концепции для CVE-2025-14847 MongoBleed Протестировано: ✅ MongoDB 7.0.5 | 14 300+ успешных эксплойтов | 4 утёкших UUID 🎯 О проекте Этот репозиторий содержит полностью...

BIT-MONGODB-2026-82069 Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypasse...

BIT-MONGODB-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

BIT-MONGODB-2026-18694 Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memo...

BIT-MONGODB-2026-18693 Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server...

BIT-MONGODB-2026-18688 Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash denial of service and may potentially expose ...

CVE-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

CVE-2026-92925 Redis: redis: out-of-bounds read via crafted cluster bus packets

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

Mongobleed-Detector-CVE-2025-14847

Сканер MongoBleed Профессиональный сканер уязвимостей для CVE-2025-14847 MongoBleed — уязвимость утечки памяти MongoDB. root@kitploit: +================================================================+ | MongoBleed Scanner v1.3.0 | | CVE-2025-14847 - MongoDB Memory Leak Vulnerability |...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' WMS-эндпоинт GeoServer уязвим к XXE-атаке 🌟 🏷️ Основная информация CVE ID : CVE-2025-58360 Опубликовано : 📅 25 ноября 2025 Последнее изменение : 📅 25 ноября 2025 всё ещё актуально на 26 ноября Тип уязвимости : XML External Entity XXE – CWE-611 Затронутое ПО : GeoServer...

CVE-2026-81438

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917

In Grav (a flat-file CMS) versions 2.0.0-rc.1 through 2.0.21 , the Twig content sandbox fails to restrict dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string). The guard GravExtension::assertSandboxDumpSafe() calls SandboxExtension::isSandboxed() without a Source argume...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92916

Grav, a flat-file CMS, is affected by an unauthenticated information disclosure in versions 1.7.0–1.7.53.2 and 2.0.0–2.0.21 when the debugger is enabled (system.debugger.enabled: true, not the default). The Clockwork profiler endpoint (/__clockwork/) is intercepted during bootstrap without any au...

CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

cve-2025-14847

MongoBleed: CVE-2025-14847 Инструмент обнаружения утечки памяти MongoBleed — это высокопроизводительный инструмент для аудита безопасности, предназначенный для обнаружения и демонстрации CVE-2025-14847. Эта уязвимость позволяет неаутентифицированному удаленному злоумышленнику сливать фрагменты...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability

Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability discovered by Sorra in WordPress Plugin LatePoint versions = 5.6.9...

CVE-2025-62168

CVE-2025-62168 — Утечка токена Squid Proxy PoC Автор не несет ответственности за неправомерное использование или ущерб, причиненный данным инструментом. Исследование предоставляется исключительно в образовательных и защитных целях. Описание Этот репозиторий содержит Proof-of-Concept PoC для...