PT-2026-110563

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO...

PT-2026-111010

Name of the Vulnerable Software and Affected Versions Matrimonial System version 1.0 Description A flaw in the processing of the db/matrimony.sql file allows remote attackers to gain unauthorized access to files or directories. Recommendations At the moment, there is no information about a newer...

PT-2026-110909

Name of the Vulnerable Software and Affected Versions itsourcecode Baptism Information Management System version 1.0 Description A SQL injection flaw exists in the pbaptism.php file. This issue occurs when the b id argument is manipulated, allowing a remote attacker to execute arbitrary SQL...

Pizzafy 1.0 Shell Upload / SQL Injection

Pizzafy version 1.0 suffers from remote shell upload and remote SQL injection vulnerabilities. Title: pizzafy-1.0-Multiple-SQLi&FU-shell-vulnerabiliries+Exploit Author: nu11secur1ty Date: 10/12/2026 Vendor: https://github.com/clararod9 Software:...

Dell System Update < 2.3.0.0 Multiple Vulnerabilities (DSA-2026-324)

According to its self-reported version, the Dell System Update DSU installation on the remote host is prior to 2.3.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2026-324 advisory. - Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitati...

CVE-2026-108922: Unrestricted Upload of File with Dangerous Type

A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file uploadsave.php. Executing a manipulation of the argument uploadedfile/image can lead to unrestricted upload. The attack may be launche...

CVE-2026-95702

A flaw was found in Google gVisor's Virtual File System VFS. A local attacker with standard container privileges can exploit this vulnerability to achieve arbitrary code execution within the host sentry process. By improperly releasing a backing memory file multiple times from an in-sandbox overl...

juicy-potato

Juicy Potato abusando de los privilegios dorados Una versión azucarada deRottenPotatoNG, con un poco de jugo, es decir, otra herramienta de Elevación de Privilegios Local, desde una Cuenta de Servicio de Windows a NT AUTHORITY\SYSTEM Resumen RottenPotatoNG y sus variantes aprovechan la cadena de...

faraday_plugins

Instalación pip install faraday-plugins Comandos Listar plugins Lista todos los plugins y si son compatibles con comandos y/o informes Parámetros opcionales: -cpf / --custom-plugins-folder PATH: Si se indica, también buscará plugins personalizados en esa ruta faraday-plugins list-plugins Probar l...

pillager

Pillager Saquea sistemas de archivos en busca de información sensible con Go. Tabla de Contenidos 1. Resumen 2. Instalación 3. Uso 4. Exfiltración 5. Documentación Resumen Pillager está diseñado para proporcionar un medio sencillo de aprovechar el sólido modelo de concurrencia de Go para buscar...

porterminal

Give your agent any computer One command. One URL. A real terminal for your agent, a live view for you. Run Porterminal on a Windows, macOS, or Linux computer and give the generated link to your AI agent. It gets a real shell with the files, tools, and projects on that machine. Open the same link...

lunar

LUNAR Lockdown UNix Auditing and Reporting Version Current version 16.6.1 Refer to lunar.sh and CHANGELOG.md for more up to date version information License CC BY-NC-SA: https://creativecommons.org/licenses/by-nc-sa/4.0/ Fund me here: https://ko-fi.com/richardatlateralblast NOTICE Run this code i...

cloudprober

cloudprober.org | Iniciar Monitoreo Ahora Cloudprober: Monitoreo de Sistemas Confiable, ¡Simplificado! Cloudprober potencia tu monitoreo con sondas activas también conocido como monitoreo sintético para garantizar que tus sistemas—homelabs, microservicios, APIs, sitios web o conexiones...

CVE-2026-19669

The user-mode syscall verifiers zvrfyfuelgaugegetprops and zvrfyfuelgaugesetprops in drivers/fuelgauge/fuelgaugesyscallhandlers.c declared two variable-length arrays, union fuelgaugepropval kvalslen and fuelgaugepropt kpropslen, sized directly by the caller-supplied len argument. len is an...

fsmon

fsmon Utilidad de monitorización de sistema de archivos de bajo nivel para Linux, Android, iOS y macOS. Autor : pancake @ nowsecure Licencia : MIT Diseñado para Administradores de sistemas y respondedores de incidentes Investigadores de seguridad y analistas forenses Desarrolladores que depuran...

CVE-2026-19669 Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

The user-mode syscall verifiers zvrfyfuelgaugegetprops and zvrfyfuelgaugesetprops in drivers/fuelgauge/fuelgaugesyscallhandlers.c declared two variable-length arrays, union fuelgaugepropval kvalslen and fuelgaugepropt kpropslen, sized directly by the caller-supplied len argument. len is an...

systeminformer

System Informer Una herramienta gratuita, potente y multipropósito que te ayuda a monitorear los recursos del sistema, depurar software y detectar malware. Traído a ti por Winsider Seminars & Solutions, Inc...

cracklord

Cracklord http://jmmcatee.github.io/cracklord/ ¿Qué Es? CrackLord es un sistema diseñado para proporcionar un sistema escalable, conectable y distribuido tanto para el descifrado de contraseñas como para cualquier otro trabajo que necesite muchos recursos informáticos. Dicho de otra manera,...

windows

Windows !Buildbuildurl !Versiontagurl !Sizetagurl !Packagepkgurl !Pullshuburl Windows dentro de un contenedor Docker. Características ✨ Ejecuta Windows dentro de un contenedor Docker Descarga automática e instalación sin intervención Soporta versiones modernas y antiguas de Windows Rendimiento ca...

CVE-2026-108869

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...