CVE-2026-98223

A flaw was found in the Linux kernel's memory management component. When dropbehind memory pages are mapped during read-ahead fault operations, the kernel can mistakenly attempt to execute a sleepable operation while running in an atomic, non-preemptible context upon writeback completion. A local...

nexphisher

Proyecto ya no mantenido. UsaZPhisher Instalación : apt update apt install git -y git clone git://github.com/htr-tech/nexphisher.git cd nexphisher CONFIGURACIÓN : bash setup CONFIGURACIÓN TERMUX : bash tmuxsetup Ejecutar : bash nexphisher Comando Único : apt update ; apt install git -y ; git clon...

EUVD-2026-91670

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications...

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...

GHSA-4JQV-MC3X-M676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...

EUVD-2026-92771

Ghost: Authorization Issue Allowed Author Role to Delete any Post...

Ghost: Authorization Issue Allowed Author Role to Delete any Post

Impact Staff with the Author role could delete posts and pages that they did not author. Vulnerable versions This vulnerability is present in Ghost from v5.81.0 up to v6.60.0. Patches v6.60.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost...

DRUPAL-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

CVE-2026-107270

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

EUVD-2026-94401

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

PT-2026-107750

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

CVE-2026-106326

A confused deputy flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511745101...

CVE-2026-105680

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0...

CVE-2026-105680

The Ghost Node.js content management system is vulnerable to an authorization issue in versions 5.81.0 through 6.60.0 . Staff members assigned the Author role can bypass intended restrictions to delete posts and pages that they did not originally author. This vulnerability is addressed in version...

ASUS DSL-AC88U Auth Bypass (CVE-2024-3080)

Exploits CVE-2024-3080 in ASUS DSL-AC88U: /js/..%2f%2f or /images/..%2f%2e traversal bypasses authentication and exposes admin wizard pages. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS DSL-AC88U path traversal auth bypass CVE-2024-3080.""" from kittysploit import from...

Yachtcontrol systemcall RCE (CVE-2019-17270)

Exploits CVE-2019-17270 in Yachtcontrol webapplication 1.0: unauthenticated OS command injection via /pages/systemcall.php?command=. !/usr/bin/env python3 -- coding: utf-8 -- """Yachtcontrol systemcall.php command injection CVE-2019-17270.""" import re import urllib.parse from kittysploit import...

FUEL CMS PHP Code Evaluation RCE (CVE-2018-16763)

Exploits CVE-2018-16763 in FUEL CMS 1.4.1 via PHP code evaluation in the /fuel/pages/select/ filter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS filter parameter PHP RCE CVE-2018-16763.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PGmtetagged if no tags are cleared or restored Prior to commit 69e3b846d8a7 “arm64: mte: Sync tags for pages where PTE is untagged”, mtesynctags was only called for ptetagged entries those mapped with...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: perf/core: Abrupt exit if the requested AUX area is out of bounds. When using perf-record with a large AUX area, for example 4GB, the following error occurs: bash perf record -C 0 -m ,4G -e armspe0// -- sleep 1 Failed to mmap wit...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

Linux block and network PV device frontends do not zero memory regions before sharing them with the backend CVE-2022-26365, CVE-2022-33740. Additionally, the granularity of the grant table does not allow sharing smaller than a 4K page, resulting in unrelated data residing in the same 4K page as...