CVE-2026-81705

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81696

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81688

opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

CVE-2026-81679

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2026-81684

In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...

CVE-2026-81664

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...

CVE-2026-75573

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

CVE-2026-11754

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2012-5519

cups-root-file-read.sh ⭐ Eine Bash-Implementierung des Metasploit-Moduls 'cupsrootfileread.rb', entwickelt für Pentesting und CTFs. Hauptsächlich eine kurze Übung in Bash-Scripting. Gedacht als eigenständiges Programm, das CVE-2012-5519 auf Linux-Systemen ausnutzt; es bietet dem Benutzer eine...

CVE-2026-42527

مرشح ObjectInputFilter الافتراضي المتساهل — أداة إعادة إنتاج القناة الجانبية لنظام DNS CVE-2026-42527 يعرض هذا المشروع ثغرة CVE-2026-42527 في Apache Camel. إن نمط ObjectInputFilter الافتراضي الذي تُصدَّر به عدة مكونات من Camel لفلترة إلغاء التسلسل دفاعًا في العمق — java.;javax.;org.apache.camel.;...

CVE-2021-38314

CVE-2021-38314 Divulgazione di informazioni sensibili senza autenticazione CVE-2021–38314...

CVE-2022-31269

CVE : CVE-2022-31269 Título do Exploit: Nortek Linear eMerge E3-Series - Divulgação de Informações permite acesso ao painel de administração...

CVE-2017-0785

CVE-2017-0785 PoC Este é apenas um estudo pessoal baseado na vulnerabilidade de vazamento de informações do Android divulgada pela Armis. Leitura adicional: https://www.armis.com/blueborne/ Para executar, certifique-se de ter pybluez e pwntools instalados. root@kitploit: sudo apt-get install...

CVE-2023-21742

CVE-2023-21742 PoC Attenzione: è solo una PoC per divulgare l'attributo/proprietà, non un EXP di RCE. root@kitploit: POST /vtibin/webpartpages.asmx HTTP/1.1 Host: splab13 SOAPAction: http://microsoft.com/sharepoint/webpartpages/ConvertWebPartFormat Upgrade-Insecure-Requests: 1 User-Agent:...

CVE-2018-10583

Exploit python3 aggiornato per CVE-2018-10583 LibreOffice/Open Office - Divulgazione di informazioni '.odt' crediti originali a : https://www.exploit-db.com/exploits/44564 Utilizzo 1. Installa il modulo ezodf con pip o pip3 2. Esegui l'exploit con python3: genererà un file bad.odt, caricalo sulla...

CVE-2024-2928

CVE-2024-2928 Exploit di lettura arbitraria dei file per CVE-2024-2928 in mlflow nello specifico nella versione 2.9.2, corretta nella versione 2.11.3 Il codice dell'exploit è stato testato su Linux Fonte: https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298 Uso: python3 CVE-2024-2928.p...

CVE-2026-67355

A flaw was found in guzzlehttp/guzzle. The software does not correctly enforce the "host-only" scope for cookies, which means it stores the request host in the cookie's domain field instead of restricting the cookie to the exact host. This vulnerability could allow an attacker who controls a...

CVE-2026-67339

A flaw was found in guzzlehttp/guzzle, where it fails to properly isolate Proxy-Authorization headers from origin servers when using cURL handlers. A remote attacker could exploit this vulnerability when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as...

CVE-2025-53136

CVE-2025-53136 Kernel-Informationsoffenlegung durch Race Condition. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43511 https://www.crowdfense.com/nt-os-kernel-information-disclosure-vulnerability-cve-2025-53136/...