grype

Grype A vulnerability scanner for container images and filesystems. Features Scan container images , filesystems , and SBOMs for known vulnerabilities see the docs for a full list of supported scan targets Supports major OS package ecosystems Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon...

seeker

Available in Concept behind Seeker is simple, just like we host phishing pages to get credentials why not host a fake page that requests your location like many popular location based websites. Read more on thewhiteh4t's Blog .Seeker Hosts a fake website which asks for Location Permission and if...

zelos

Zelos Zelos Z eropoint E mulated L ightweight O perating S ystem is a python-based binary emulation platform. One use of zelos is to quickly assess the dynamic behavior of binaries via command-line or python scripts. All syscalls are emulated to isolate the target binary. Linux x8664 32- and...

EUVD-2026-125271

Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints registerProcessDefinition and runProcessDefinition require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the ROLEUSER role c...

Kernel-Exploits

Kernel Exploits Repository for kernel exploits...

beef

=============================================================================== Copyright c 2006-2026 Wade Alcorn - [email protected] Browser Exploitation Framework BeEF - https://beefproject.com See the file 'doc/COPYING' for copying permission...

ROOT-OS-DEBIAN-11-CVE-2026-56407 CVE-2026-56407 in expat - Patched by Root

Root has patched CVE-2026-56407 in the expat package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-48074 CVE-2025-48074 in openexr - Patched by Root

Root has patched CVE-2025-48074 in the openexr package for Root:Debian:13. Multiple fixed versions available...

cve-2024-3400

cve-2024-3400 Python exploit and checker script for CVE-2024-3400 Palo Alto Command Injection and Arbitrary File Creation usage: cve-2024-3400.py -h exploit,check ... CVE-2024-3400 - Palo Alto OS Command Injection positional arguments: exploit,check Available modules exploit Exploit module of...

umap

umap - the USB host security assessment tool Based on Facedancer by Travis Goodspeed: http://goodfet.sourceforge.net/hardware/facedancer21/ Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com...

Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal

The web server of Lawo AG vsm LTC Time Sync vTimeSync is affected by a "..." triple dot path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only...

Rejetto HTTP File Server 2.4.x - Template Injection

Rejetto HTTP File Server HFS 2.4.x inserts the multipart upload filename into the server-side template symbol map as %item-resource% without escaping. A filename containing the literal %item-resource% is substituted a second time by the sequential global replacement in xtpl, allowing a : sequence...

sar2html <=3.2.2 Plot Parameter - Remote Code Execution

sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands. id: CVE-2025-34030 info: name: sar2html...

Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

PXEThief

PXEThief PXEThief is a set of tooling that implements attack paths discussed at the DEF CON 30 talk Pulling Passwords out of Configuration Manager https://forum.defcon.org/node/241925 against the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager or ConfigMgr,...

CVE-2026-124702

Progress Telerik UI for WPF versions prior to 2026.4.1110 are vulnerable to an untrusted URL redirection vulnerability (CWE-601 ). This flaw allows an attacker to trigger arbitrary operating system protocol handlers using attacker-controlled arguments. The attack is executed when a user opens a c...

os-experiment-4

os-experiment-4 os experiment 4 CVE-2016-5195 ./run.sh...

CraftCMS-CVE-2026-79987

CraftCMS CVE-2026-79987 — Authenticated RCE Public PoC for CVE-2026-79987 Craft CMS: a Control Panel user with only the accessCp permission can execute operating-system commands as the PHP web worker, via ElementSearchController::actionSearch accepting criteria.with.when — Craft copies it into...

EUVD-2026-123811

An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 XCC3 versions 2.51 IHX432Y to 2.56 IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation. An attacker can gain access to enabled...

CVE-2026-120148: n/a PostgreSQL: Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating…

Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session...