CVE-2025-56399

CVE-2025-56399 Mass Exploit CVE-2025-56399 – Remote Code Execution in laravel-file-manager v3.3.1. Exploits misconfigured config in Laravel File Manager to upload and verify a PHP shell via unauthenticated file upload. Installation Download repository root@kitploit: git clone...

CVE-2026-85021 langgenius dify Splash Layout splash.tsx router.replace cross site scripting

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirecturl causes cross site scripting. The attack is possible to be carried o...

CVE-2026-85021

langgenius/dify version 1.13.0 is affected by a cross-site scripting (XSS) vulnerability in the Splash Layout component, specifically in the router.replace function within web/app/(shareLayout)/components/splash.tsx. The root cause is improper handling of the redirect_url argument, allowing remot...

EUVD-2026-70297

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirecturl causes cross site scripting. The attack is possible to be carried o...

CVE-2026-85021 langgenius dify Splash Layout splash.tsx router.replace cross site scripting

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirecturl causes cross site scripting. The attack is possible to be carried o...

CVE-2022-22965

POC Spring4Shell CVE-2022-22965 Spring4Shell CVE-2022-22965 Proof Of Concept. The naming of this flaw is based on the similarities to the infamous Log4j LOG4Shell. Details about this vulnerability https://websecured.io/blog/624411cf775ad17d72274d16/spring4shell-poc...

oxasploits

oxasploits A number of exploits written by oxagast Most of these CVEs are accreddited to oxagast as well Contact: Marshall Whittaker [email protected] CVEs and PoC code CVE-2006-3392 Webmin =1.29 remote root exploit This exploit, lifts a Webmin cookie with a directory transversal and aritrar...

PT-2026-85266

Name of the Vulnerable Software and Affected Versions TP-Link Archer AX55 v4 versions prior to 1.2.1 Build 20260527 Description A stack-based buffer overflow exists in the EasyMesh module. When Mesh mode is enabled, a LAN attacker can submit crafted input to the EasyMesh daemon, which may cause t...

PT-2026-85288

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description A remote code execution issue exists in the SplitHandler::handlePreCheckSplitDir function of alogsplit. The software fails to sanitize shell metacharacters within log file pathnames, allowing...

PT-2026-85205

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoi...

PT-2026-85239

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.82 Description An out of bounds write occurs in WebGL, which is a JavaScript API for rendering high-performance interactive 3D and 2D graphics within any compatible web browser. This issue...

PT-2026-85242

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description Improper resource exposure in CacheStorage allows a remote attacker to execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-85240

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description A type confusion issue exists in the Compositing component. This allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted...

PT-2026-85286

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description Multiple buffer overflow issues exist in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched...

PT-2026-85001

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.73 n8n versions prior to 2.35.4 n8n versions prior to 2.36.2 Description An expression sandbox escape exists in the $fromAI handler. The $fromAI handler resolved caller-supplied placeholder names without verifying i...

Roundcube Webmail 1.6.x < 1.6.18 / 1.7.x < 1.7.3 Multiple Vulnerabilities

The remote web server is running Roundcube Webmail version 1.6.x prior to 1.6.18 or 1.7.x prior to 1.7.3. It is, therefore, affected by multiple vulnerabilities: - The cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This iss...

Next.js Framework 15.5.x < 15.5.21 / 16.x < 16.2.11 Image Optimization API DoS (GHSA-q8wf-6r8g-63ch)

The Next.js Framework on the remote host is affected by a denial of service vulnerability: - When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, the...

Linux Distros Unpatched Vulnerability : CVE-2026-65139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix various issues in unsafe operation/queries to the slurmdbd CVE-2026-65139 Note that Nessus relies on the...

The vulnerability of the JNDIRealm component in the Apache Tomcat application server allows a hacker to bypass security restrictions.

The vulnerability of the JNDIRealm component in the Apache Tomcat application server is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions remotely...

PT-2026-85206

A critical WHMCS security update fixes CVE-2026-67399 and CVE-2026-67398. Apply the patch now to prevent remote code execution and data leaks. WHMCS CyberSecurity CVE202667399 CVE202667398 InfoSec https://t.co/LuCYwv3icN https://t.co/BNvTvGIUBc...