Important: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

EUVD-2026-80894

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure

PRTG-Network-Monitor-Information-Disclosure - CVE-2020-11547 Remote unauthenticated user can craft an HTTP request in /public/login.htm or /index.htm by providing the 'type' parameter. Example: http://127.0.0.1/public/login.htm?type=probes replace probes by any of the following to get diferent in...

CVE-2026-3288-lab

CVE-2026-3288 Vulnerable Lab Docker NGINX Ingress Controller Configuration Injection ⚠️ WARNING : This lab contains intentionally vulnerable configurations for AUTHORIZED SECURITY TRAINING ONLY Vulnerability Overview CVE-2026-3288 CVSS 8.8 HIGH - Configuration injection in NGINX Ingress Controller...

CVE-2026-64753

A flaw was found in WebKitGTK. Processing malicious web content can disclose sensitive user information due to a permissions issue. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2025-27817

Disclaimer: The vulnerabilities and reproduction steps described in this document are for cybersecurity research and educational purposes only. No one may use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no liability for any...

CVE-2026-87028

CVE-2026-87028 is a cross-board Insecure Direct Object Reference (IDOR) in the Board Custom Slot Preview endpoint of Concrete CMS 9.0.0 through 9.5.3 . The endpoint failed to verify that a submitted InstanceItem belonged to the board instance the requesting user was authorized to edit, and did no...

EUVD-2026-80881

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

PoC-CVE-2026-21858

PoC-CVE-2026-21858 n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remo...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution Broken Access Control Unauthenticated PII disclosure and order forgery in the Eventin WordPress plugin 10,000+ active installs. A public REST endpoint hands out a wprest nonce to any visitor, and three downstream permission callbacks accept that nonce as a...

CVE-2026-53959

CVE-2026-53959 - 4gaBoards 3.3.9 - User Information Disclosure This repo contains a Proof of ConceptPoC exploit for CVE-2026-53959 Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permissio...

CVE-2024-44313

Exploit 🛠️ Case Study: CVE-2024-44313 and EPSS in Vulnerability Prioritization This case study was developed for a talk on EPSS Exploit Prediction Scoring System, demonstrating how the score can influence vulnerability prioritization in practice. The CVE-2024-44313 vulnerability, found in...

sap_igs_xxe

SAP IGS XXE attack CVE-2018-2392 and CVE-2018-2393 This module in Metasploit Framework Documentation Module Vulnerable Application This module exploits CVE-2018-2392 and CVE-2018-2393, two XXE vulnerabilities within the XMLCHART page of SAP Internet Graphics Servers IGS running versions 7.20,...

kernel-exploits

Linux 内核漏洞利用 日期| 链接| 描述| 攻击向量| 影响 ---|---|---|---|--- 02.2016| CVE-2016-2384| USB MIDI 驱动程序中的双重释放| USB + 本地| 本地权限提升 03.2016| prefetch-side-channel| 通过 prefetch 绕过 KASLR| 本地| 信息泄露 12.2016| CVE-2016-9793| 套接字缓冲区中的符号性问题| 本地 + capnetadmin| 本地权限提升 02.2017| CVE-2017-6074| DCCP 套接字中的双重释放| 本地| 本地权限提升...

Important: Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

An update for .NET 9.0 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-61595

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2020-25078

CVE-2020-25078 Instructions instructions Place the attack URLs in the same directory as ip.txt The attack IP is placed in the same directory as ip.txt Terminal log root@localhost:/CVE-2020-25078ls CVE-2020-25078.py ip.txt root@localhost:/CVE-2020-25078cat ./ip.txt https://xxx.xxx.xxx.xxx:3128...

CVE-2024-24919-POC

CVE-2024-24919 PoC 🚀 🔥 Description This script automates the exploitation of CVE-2024-24919 Checkpoint Security Gateway Unauthorized Information Disclosure. 📌 Features ✅ Single & Bulk URL Testing ✅ Automated Exploitation ✅ Simple & Fast 🛠️ Usage Clone this repo and run the script: root@kitploit:...

ktor-xxe

ktor-xxe Run the project with : | ./gradlew run | Run the server | If the server starts successfully, you'll see the following output: root@kitploit: 2024-12-04 14:32:45.584 main INFO Application - Application started in 0.303 seconds. 2024-12-04 14:32:45.682 main INFO Application - Responding at...