CVE-2026-37012

PentestGPT 1.0.0 contains a vulnerability in pentestgpt/core/langfuse.py where hardcoded API credentials allow remote attackers to disclose sensitive user telemetry data . The root cause is the presence of static API keys embedded in the source code at the file referenced in the GitHub repository...

PT-2026-82737

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

PT-2026-82744

A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...

PT-2026-82773

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...

PT-2026-82411

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

CVE-2026-79146

Information leak in CustomTabs in Google Chrome on on Android prior to...

meta-ai-support-prompt

Prompt di sistema di Meta AI Support Assistant Prompt di sistema estratto da Meta AI Support Assistant il 1 giugno 2026. File system-prompt.md — Prompt di sistema estratto ⚠️ Disclaimer e Avviso legale Scopo Questo repository è pubblicato esclusivamente per scopi educativi e di ricerca sulla...

dp_cryptomg

dpcryptomg Un altro strumento per sfruttare CVE-2017-9248, una debolezza crittografica nel dialog handler di Telerik UI for ASP.NET AJAX. Lo sfruttamento consente di accedere a un'utilità di gestione file in grado di caricare file arbitrari, portando di solito a un'esecuzione remota di codice. La...

CVE-2023-21688

Big fire collab com @cof123 sobre vazamento de informações de SIDECHANNEL + CVE-2022-38029 cadeiaKALPC UAF+ carrotc4k3 sidechannel Em construção... Por favor, volte mais tarde... Ainda não terminado...

longtongue

Gere listas de senhas/frases personalizadas com base em informações do alvo Codificado com 💙 por edoardottt Compartilhe no Twitter! Instalação ⬇️ pipx root@kitploit: pipx install longtongue Fonte root@kitploit: git clone https://github.com/edoardottt/longtongue.git cd longtongue pip install -r...

DEBIAN-CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

CVE-2026-21808

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details...

CVE-2025-62341

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2026-80183

OpenStack Keystone before 29.0.3 is vulnerable to a broken access control flaw in list_role_assignments_for_tree, caused by misuse of "None" in the policy domain_id check. Because a domain's project record stores domain_id=null, any authenticated user holding role:reader on any project can pass a...

CVE-2026-80183

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...

CVE-2026-80183

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...

CVE-2024-24919-Exploit

CVE-2024-24919-Exploit 概述 此仓库包含针对 CVE-2024-24919 的 Python 漏洞利用代码，该漏洞允许您从存在漏洞的页面读取敏感文件。 此漏洞利用首先检查目标是否易受攻击，然后获取您指定的路径。 严重程度 : 严重 用法 首先克隆仓库： root@kitploit: git clone https://github.com/Rug4lo/CVE-2024-24919-Exploit cd CVE-2024-24919-Exploit 赋予权限并使用 python3 执行漏洞利用 root@kitploit: chmod +x exploit.py...

CVE-2025-69428

Avviso di Sicurezza - CVE-2025-69428 Titolo: Accesso Non Autenticato a Directory Sensibile Divulgazione di Informazioni ID CVE: CVE-2025-69428 Descrizione Una vulnerabilità critica di controllo degli accessi nell'applicazione Pro-Bit distribuita localmente nelle versioni precedenti alla v1.77.4...

internal-security-detect

Rilevamento della Sicurezza Interna tramite Safebase I portali SafeBase esposti servono due tipi di pubblico contemporaneamente: i potenziali clienti che necessitano di prove della tua postura di sicurezza e i ricercatori di sicurezza blue team e red team. Ogni spunta verde rivela un controllo ch...