CVE-2026-55247

plone.app.event , Plone's event content type, contains multiple issues in its iCalendar import (src/plone/app/event/ical/importer.py) prior to versions 5.2.4 and 6.0.1 . The importer accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported ...

CVE-2019-1064

CVE-2019-1064 - AppXSVC Lokale Berechtigungserhöhung https://www.rythmstick.net/posts/cve-2019-1064/...

CVE-2026-59310

CVE-2026-59310 PoC https://trap.biu.life/intelligence/6a82873feb679015eb4c8a67 root@kitploit: echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 root@kitploit: GET...

CVE-2026-40345

deepmerge-ts 8.0.0: DoS durch rekursiven Objektgraphen Ich habe einen Stack-Erschöpfungsfehler in deepmerge-ts-Versionen vor 8.0.0 reproduziert. Das Interessante daran ist, dass der Absturz kein riesiges verschachteltes Objekt benötigt. Er entsteht durch Objektidentität. Wenn beide...

CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Umgebung Prinzip: JSON-Füllung vom serverseitig aktivierten JSON-Body-Plugin „JSON-Füllung“ ist eine Kernfunktion des JSON-Plugins in Struts 2 und kann vereinfacht als ein automatischer Datenkonvertierungsmechanismus verstanden werden. Der Parser der...

FTP-vsFTPD-CVE-2011-2523-VAPT-Report

REPORT VAPT vsFTPD CVE-2011-2523 Target: Metasploitable 2 Tester: Analista di Sicurezza Data: 24 giugno 2026 Ambito: Test interno di laboratorio Kali Linux → Metasploitable 2 📌Sommario Esecutivo È stata eseguita una scansione delle vulnerabilità utilizzando lo script di scansione delle...

CVE-2026-55520

Protego is a pure-Python robots.txt parser. Prior to 0.6.2 , the _URLPattern._prepare_pattern_for_regex method in src/protego/_urlpattern.py translates every asterisk in an Allow or Disallow directive into a lazy regex wildcard. A directive containing many asterisks triggers exponential backtrack...

plone.app.portlets vulnerable to denial of service via RSS feed portlet

Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

EUVD-2026-67864

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in...

CVE-2026-55248

plone.app.portlets (Plone CMS) is vulnerable to three issues in its RSS feed portlet, all fixed in versions 5.0.8, 6.0.4, and 7.0.2 . A low-privileged member can set the RSS feed URL to a very large response, causing excessive in-memory data retention and denial of service via the FEED_DATA cache...

gogs

👉 Distribuisci su DigitalOcean e ottieni $200 in crediti gratuiti! 🔮 Visione Il progetto Gogs /gɑgz/ mira a costruire un servizio Git self-hosted semplice, stabile ed estensibile che possa essere configurato nel modo più indolore possibile. Con Go, questo può essere realizzato con una distribuzio...

CVE-2023-31014_Lab

CVE-2023-31014 Lab zum Hijacking impliziter Intents Dies ist ein zu Lehrzwecken erstelltes Android-Lab, das auf dem öffentlichen Bericht zu CVE-2023-31014 in NVIDIA GeForce NOW for Android basiert. Es enthält weder NVIDIA-Quellcode noch echte Action-Strings oder echte Anmeldeinformationen. Fakten...

EUVD-2026-66110

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption...

CVE-2026-18649

CVE-2026-18649 - GStreamer rtph264depay: DoS per crescita illimitata della memoria Proof of concept per una vulnerabilità di esaurimento delle risorse nel depayloader RTP H.264 di GStreamer rtph264depay. Lo stesso schema interessa anche rtph265depay. Cos'è Durante il riassemblaggio RTP frammentat...

CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath

CVE-2026-21008 – Token dell'account di servizio Kubernetes montato in HostPath Codice del programma YAML + exploit Python root@kitploit: vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec:...

CVE-2026-11118-HTTP-2-Rapid-Reset-DDoS

CVE-2026-11118 – HTTP/2 Rapid Reset DDoS Codice del programma client + server Python/http2 root@kitploit: http2serversim.py - Simple HTTP/2 server that processes reset streams import socket, ssl, h2.connection, h2.events def handle: sock = socket.socket sock.setsockoptsocket.SOLSOCKET,...

CVE-2026-3333-DNS-Rebinding-to-Steal-Cloud-Metadata

CVE-2026-3333 – DNS Rebinding per rubare i metadati cloud Codice del programma server attaccante Python + app vulnerabile root@kitploit: !/usr/bin/env python3 dnsrebindingserver.py - Malicious DNS server that alternates between attacker IP and 169.254.169.254 import socket, threading, time This...

CVE-2026-2020-SSRF-via-URL-Parser-Differential

CVE-2026-2020 – SSRF tramite differenziale del parser URL Codice del programma Python root@kitploit: vulnerableservice.py - Validates URL with urllib.parse, fetches with requests from flask import Flask, request import requests import urllib.parse app = Flaskname def isallowedurlurl: parsed =...

GHSA-962X-CCWF-8X6P Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...