BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE

Summarybbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution RCE.bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution RCE. ImpactA user who uses bbot t...

Exploit for CVE-2025-0133

CVE-2025-0133 Scanner Palo Alto PAN-OS GlobalProtect Reflecte...

GitHub Org Exposure Scanner

Discover public GitHub repositories tied to a target domain/org, scan README and workflow files for secret patterns, and surface CI/CD misconfigurations. from kittysploit import import json import re from urllib.parse import quote from lib.protocols.http.httpclient import Httpclient class...

FreeBSD : PowerDNS -- vulnerabilities (a8614190-73b4-11f1-910d-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a8614190-73b4-11f1-910d-3c7c3fba4204 advisory. PowerDNS Team reports: Thanks to people below for reporting these vulnerabilities: Thanks to...

CVE-2026-37637: Improper Control of Generation of Code

An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component...

CVE-2026-57947: Server-Side Request Forgery (SSRF)

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to...

CVE-2026-56781: Authorization Bypass Through User-Controlled Key

Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from shar...

CVE-2026-57340: Missing Authorization

Unauthenticated Broken Access Control in Japanized For WooCommerce = 2.9.12 versions...

CVE-2026-57339: Missing Authorization

Unauthenticated Broken Access Control in Business Directory = 6.4.23 versions...

CVE-2026-57338: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

CVE-2026-57334: Missing Authorization

Unauthenticated Broken Access Control in WP User Frontend = 4.3.7 versions...

CVE-2026-57333: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Link Whisper Free = 0.9.4 versions...

CVE-2026-57331: Improper Limitation of a Pathname to a Restricted Directory

Performer Arbitrary File Deletion in Paid Videochat Turnkey Site = 7.4.8 versions...

CVE-2026-57330: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

CVE-2026-57327: Missing Authorization

Subscriber Broken Access Control in MainWP = 6.1.1 versions...

CVE-2026-57326: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.22 versions...

CVE-2026-56457: Insertion of Sensitive Information into Log File

HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with access to the logs to potentially obtain sensitive values related to that step...

CVE-2026-57676: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9...

CVE-2026-57335: Missing Authorization

Subscriber Broken Access Control in Ads by WPQuads = 3.0.3 versions...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in scanner.rb. An attacker can cause a stack overflow and crash the application by supplying CSS input containing numerous adjacent comments. Remediation Upgrade crass to version 1.0.7 or higher. References -...