CVE-2026-6336: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check...

Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091

An advisory for this issue has been issued at https://www.drupal.org/sa-contrib-2026-110 and an additional issue was identified and fixed via https://www.drupal.org/sa-contrib-2026-111 This module is now resupported. See that advisory for more details. Original content The security team is markin...

PT-2026-66340

Name of the Vulnerable Software and Affected Versions Disable Login Page versions . Description A security issue exists in the Disable Login Page project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue. Recommendations At the moment, there...

Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

cve-lite-cli v1.28.0

Most tools tell you what's wrong. CVE Lite CLI tells you what to run. CVE Lite CLI 🏆 Officially recognized as anOWASP Lab Project Vulnerability scanning that starts in your terminal and fits cleanly into CI. Scan your lockfile, get copy-and-run fix commands, and ship clean code. Scan. Understand...

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefixpath, safedir. This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator...

MINI-4PRJ-PH7R-V282

Bulletin has no description...

CVE-2026-13980

An incorrect security ui flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513989973...

CVE-2026-14382

An insufficient validation of untrusted input flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=250000 https://code.google.com/p/chromium/issues/detail?id=492218546...

Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting Detection

Jenkins Gitlab Hook 1.4.2 and earlier does not escape project names in the buildnow endpoint, resulting in a reflected cross-site scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins Gitlab Hook 1.""" from kittysploit import from lib.protocols.http.httpclient import...

Art Gallery Management System Project v1.0 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar. !/usr/bin/env python3 -- coding: utf-8 ...

Google Cloud Ignore File Exposure Detection

Detected exposed .gcloudignore files which may reveal directory structure,deployment configurations, and sensitive project information used by Google Cloud SDK gcloud during deployments. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed .""" from kittysploit import from...

Project Insight Login Panel - Detect

Project Insight login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Project Insight login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Project Insight Login Panel - Detect',...

Testignore - File Disclosure Detection

Detected that the .testignore file was publicly accessible, potentially revealing the project structure, sensitive file paths, and internal directory organization. !/usr/bin/env python3 -- coding: utf-8 -- """Detected that the .""" import re from kittysploit import from...

Palo Alto Expedition Project Login - Detect

Palo Alto Expedition Project login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto Expedition Project login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Palo Alto...

GLPI Panel - Detect

GLPI panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GLPI panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GLPI Panel - Detect', 'description': 'GLPI panel was detected.', 'author'...

Cockpit Project Login Panel - Detect

Cockpit Project products was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cockpit Project products was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cockpit Project Login Panel - Detect',...

Jira Unauthenticated Projects Detection

Detects Jira Unauthenticated Projects. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jira Unauthenticated Projects.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jira Unauthenticated Projects Detection',...

FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure Detection

FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates a valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device...

Vikunja Login Panel - Detect

Vikunja login panel was detected. Vikunja is a self-hosted to-do and project management application. !/usr/bin/env python3 -- coding: utf-8 -- """Vikunja login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...