CVE-2026-59288

The GraphiQL page bundled with Spring for GraphQL sends requests to the application's GraphQL endpoints. An attacker can share a malicious URL that, when visited by a victim, causes the victim's browser to leak confidential information to the attacker's website. This is an information exposure is...

EUVD-2026-67177

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

CVE-2021-3310

CVE-2021-3310 Western Digital MyCloud PR4100 – Schwachstelle zur Offenlegung von Informationen durch Linkauflösung Verwenden Sie die enthaltenen Dateien, um die Schwachstelle auf mycloud OS 3 auszulösen; in OS 5 wurde sie behoben...

cve-2021-38314

CVE-2021-38314 Exploit Python Dettagli Il plugin Gutenberg Template Library & Redux Framework = 4.2.11 per WordPress registrava diverse azioni AJAX disponibili agli utenti non autenticati nella funzione includes in redux-core/class-redux-core.php, uniche per un dato sito ma deterministiche e...

meg

meg meg is a tool for fetching lots of URLs but still being 'nice' to servers. It can be used to fetch many paths for many hosts; fetching one path for all hosts before moving on to the next path and repeating. You get lots of results quickly, but non of the individual hosts get flooded with...

CVE-2024-55557

CVE-2024-55557 Utilizzo root@kitploit: python3 exploit.py --local retrieve from local readable files python3 exploit.py default mode is remote Altro Leggi di più su CVE-2024-55557 - Weasis 4.5.1 POC https://github.com/user-attachments/assets/a3f64a58-7720-4f93-8bcc-9393d8afcb68...

CVE-2026-81705

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81696

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81688

opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

CVE-2026-81679

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2026-81684

In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...

CVE-2026-81664

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...

CVE-2026-75573

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

CVE-2026-11754

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2012-5519

cups-root-file-read.sh ⭐ Eine Bash-Implementierung des Metasploit-Moduls 'cupsrootfileread.rb', entwickelt für Pentesting und CTFs. Hauptsächlich eine kurze Übung in Bash-Scripting. Gedacht als eigenständiges Programm, das CVE-2012-5519 auf Linux-Systemen ausnutzt; es bietet dem Benutzer eine...

CVE-2026-42527

مرشح ObjectInputFilter الافتراضي المتساهل — أداة إعادة إنتاج القناة الجانبية لنظام DNS CVE-2026-42527 يعرض هذا المشروع ثغرة CVE-2026-42527 في Apache Camel. إن نمط ObjectInputFilter الافتراضي الذي تُصدَّر به عدة مكونات من Camel لفلترة إلغاء التسلسل دفاعًا في العمق — java.;javax.;org.apache.camel.;...

CVE-2021-38314

CVE-2021-38314 Divulgazione di informazioni sensibili senza autenticazione CVE-2021–38314...

CVE-2022-31269

CVE : CVE-2022-31269 Título do Exploit: Nortek Linear eMerge E3-Series - Divulgação de Informações permite acesso ao painel de administração...

CVE-2017-0785

CVE-2017-0785 PoC Este é apenas um estudo pessoal baseado na vulnerabilidade de vazamento de informações do Android divulgada pela Armis. Leitura adicional: https://www.armis.com/blueborne/ Para executar, certifique-se de ter pybluez e pwntools instalados. root@kitploit: sudo apt-get install...