CVE-2026-71862

Checkmate (open-source self-hosted monitoring tool) versions 3.3.0 through 3.9.2 are vulnerable to sensitive credential exposure . When the global showURL setting is enabled, the unauthenticated endpoint GET /api/v1/status-page/:url returns complete monitor objects from statusPageController.ts, i...

EUVD-2026-64039

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

EUVD-2026-63999

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

EUVD-2026-63935

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780

Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 contain an authorization bypass (IDOR) in the POST /transaction/save endpoint. A user with transaction and accounting creation permissions can supply a bank_account_id or bank_card_id belonging to another company, and the value is persisted a...

CVE-2026-73673

CVE-2026-73673: Netis NC63 における未認証ファームウェア更新と暗号学的ファームウェア認証の欠如 脆弱性のオリジナル研究: Özcan Ersan @ozcanpng。 このリポジトリは、著者が発見し報告したCVE-2026-73673を文書化したものです。 CVE-2026-73673 に関する非破壊的な概念実証（PoC）と証拠パッケージです。 Netis NC63 ファームウェア V3.0.0.3327 は、特権を要するファームウェア更新エンドポイント /cgi-bin/uploadfw.cgi...

WordPress AI Agent by SiteGround plugin <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Media Upload via /generate-content REST Endpoint vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SG AI Studio versions = 1.2.7...

CVE-2024-51428-PoC

CVE-2024-51428 - PoC слепой SQL-инъекции в ZoneMinder Python-обёртка для sqlmap , предназначенная для эксплуатации CVE-2024-51428 в ZoneMinder. Этот инструмент автоматизирует обнаружение и эксплуатацию уязвимости Blind SQL Injection , при этом вывод остаётся чистым и сосредоточенным на полезных...

EUVD-2026-63817

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type...

CVE-2026-16575

CVE-2026-16575 affects the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin in versions prior to 5.0.14 . The vulnerability is an unauthenticated information disclosure caused by a missing access restriction on a store REST endpoint that returns per-vendor commissio...

CVE-2026-39987

CVE-2026-39987 marimo는 반응형 Python 노트북입니다. 0.23.0 이전 버전의 Marimo에는 사전 인증Pre-Auth RCE 취약점이 있습니다. root@kitploit: / | |// / / / / / / |/ |/ \ / | | | \ /| | /| //|/|/ / | | | / -----/ | |/ |/ ----- \ | |/ \ / / / / //// / | |// CVE-2026-39987 Marimo /terminal/ws — 인증되지 않은 WebSocket 사전 인증...

mig

本包提供了 Go 语言中读写 INI 文件的功能。 功能特性 支持覆盖加载多个数据源（byte、文件和 io.ReadCloser） 支持递归读取键值 支持读取父子分区 支持读取自增键名 支持读取多行的键值 支持大量辅助方法 支持在读取时直接转换为 Go 语言类型 支持读取和 写入 分区和键的注释 轻松操作分区、键值和注释 在保存文件时分区和键值会保持原有的顺序 下载安装 使用一个特定版本： root@kitploit: go get gopkg.in/ini.v1 使用最新版： root@kitploit: go get github.com/go-ini/ini 如需更新请添加 -u...

SpookFlare

SpookFlare SpookFlare предлагает иной подход к обходу мер безопасности и даёт вам возможность обходить средства защиты конечных точек как на стороне клиента, так и на стороне сети. SpookFlare — это генератор загрузчиков/дропперов для Meterpreter, Empire, Koadic и др. SpookFlare обладает функциями...

sinter

Sinter Sinter is a 100% user-mode endpoint security agent for macOS 10.15 and above, written in Swift. Sinter uses the user-mode EndpointSecurity API to subscribe to and receive authorization callbacks from the macOS kernel, for a set of security-relevant event types. The current version of Sinte...

sinter

Sinter Sinter — это 100% пользовательский агент безопасности конечных точек для macOS 10.15 и выше, написанный на Swift. Sinter использует пользовательский API EndpointSecurity для подписки и получения обратных вызовов авторизации от ядра macOS для набора типов событий, связанных с безопасностью...

CVE-2026-76156

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

CVE-2026-76158

Datiphy Data Management Center (v8.3.0 through v8.5.1) contains a path traversal vulnerability in its upload API endpoint. An unauthenticated remote attacker can supply relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory, enabling arbitr...