gmailc2

gmailc2 root@kitploit: A Fully Undetectable C2 Server That Communicates Via Google SMTP to evade Antivirus Protections and Network Traffic Restrictions Note: root@kitploit: This RAT communicates Via Gmail SMTP or u can use any other smtps as well but Gmail SMTP is valid because most of the...

CVE-2025-26206

🚨 CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 Welcome to the official repository documenting the discovery and details of CVE-2025-26206 , a critical Cross-Site Request Forgery CSRF vulnerability in Sell Done Storefront v.1.0. Discovered by B. Sibhi , this...

bpflock

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...

cpiopwn

cpiopwn CVE-2021-38185 Esta es una POC Prueba de Concepto de tipo ACE Ejecución de Código Arbitrario de un error de desbordamiento de enteros en cpio. Este exploit evita todas las protecciones binarias excepto RELRO completo. Este exploit usa cpio 2.13 y libc 2.31. Video demo:...

rasputin

RASPutin Ressources and papers related to my conferences and work on unRASPs. These work is in progress, please be patient : Don't hesitate to contribute / contact me / do PR ! Talks Insomni'hack 2022 - Forging golden hammer against Android app protections This talk is the first from a new serie...

CVE-2026-75777

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...

CVE-2026-75777 Multiple vulnerabilities in IBM Aspera Enterprise Webapps

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...

CVE-2026-21807

HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow...

CVE-2026-21807

HCL BigFix Quantum Risk Analyzer is affected by a vulnerability in its binary, which lacks several critical, industry-standard hardening protections. This absence could allow an attacker to cause a stack-based buffer overflow , potentially leading to crashes or arbitrary code execution. Affected ...

CVE-2026-21807 HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow

HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL. There is an issue where insufficient efforts are made to ensure safe operation when a privileged user is managing objects of another user. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activate relevant...

CVE-2026-65432

Apache CXF is affected by an XXE in WSDL/XSD import parsing. The hardened StaxUtils path disables DTDs and external entities only for the top-level WSDL, but imported documents (wsdl:import /xsd:import ) are handed to WSDL4J, which does not disable DOCTYPE declarations or external entities, so im...

EUVD-2026-53355

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf. The endpoint validates only that the initial...

CVE-2026-71270

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...

CVE-2026-69250

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

The vulnerability of the Geomap panel on the Grafana monitoring and observation platform allows a intruder to execute arbitrary code.

The vulnerability of the Geomap panel of the Grafana monitoring and observation platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

CVE-2026-12991

The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot APK v5.5.0 exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch...

The vulnerability of the Content Credentials SDK libraries, related to insufficient validation of input data, allows attackers to circumvent existing security restrictions.

The vulnerability of the Content Credentials SDK libraries is related to insufficient validation of input data. Exploiting this vulnerability could allow attackers to circumvent existing security restrictions...

Imperva Customers Protected Against “wp2shell” Pre-Authentication RCE in WordPress Core

TL;DR : A critical pre-authentication Remote Code Execution RCE vulnerability, dubbed "wp2shell" CVE-2026-63030, has been identified in WordPress Core. This vulnerability allows an unauthenticated attacker to execute arbitrary code on a vulnerable WordPress installation without any preconditions,...