qu1ckdr0p2

About Rapidly host payloads and post-exploitation bins over HTTP or HTTPS. Designed to be used on exams like OSCP / PNPT or CTFs HTB / etc. Pull requests and issues welcome. As are any contributions. Qu1ckdr0p2 comes with an alias and search feature. The tools are located in the qu1ckdr0p2-tools...

CVE-2026-96286 Apache Thrift: Perl servers end `serve()` when serving one connection fails

Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96277 Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-84292 vulnerabilities

Vulnerabilities for packages: yaml-language-server, prism, wazuh-dashboard-fips, wazuh-dashboard, gitlab-rails-ce, keep, unleash, serve, unleash-proxy, vitess, nextcloud-server, renovate, opensearch-dashboards...

GHSA-QW65-CVWX-89V3 vulnerabilities

Vulnerabilities for packages: yaml-language-server, prism, wazuh-dashboard-fips, wazuh-dashboard, gitlab-rails-ce, keep, unleash, serve, unleash-proxy, vitess, nextcloud-server, renovate, opensearch-dashboards...

GHSA-58MR-GQGX-XQ4G vulnerabilities

Vulnerabilities for packages: yaml-language-server, prism, wazuh-dashboard-fips, wazuh-dashboard, gitlab-rails-ce, keep, unleash, serve, unleash-proxy, vitess, nextcloud-server, renovate, opensearch-dashboards...

CVE-2026-84394 vulnerabilities

Vulnerabilities for packages: yaml-language-server, prism, wazuh-dashboard-fips, wazuh-dashboard, gitlab-rails-ce, keep, unleash, serve, unleash-proxy, vitess, nextcloud-server, renovate, opensearch-dashboards...

CVE-2026-84292 vulnerabilities

Vulnerabilities for packages: serve, opensearch-dashboards, prism, yaml-language-server, renovate, vitess...

GHSA-QW65-CVWX-89V3 vulnerabilities

Vulnerabilities for packages: serve, opensearch-dashboards, prism, yaml-language-server, renovate, vitess...

GHSA-58MR-GQGX-XQ4G vulnerabilities

Vulnerabilities for packages: serve, opensearch-dashboards, prism, yaml-language-server, renovate, vitess...

CVE-2026-84394 vulnerabilities

Vulnerabilities for packages: serve, opensearch-dashboards, prism, yaml-language-server, renovate, vitess...

BIT-RCLONE-2026-93987 rclone serve docker Path Traversal via Volume Name

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

CVE-2026-47668

CVE-2026-47668 — DbGate 원격 코드 실행 DbGate JSON 스크립트 러너dbgate-serve ≤ 7.1.8의 인증되지 않은 RCE. 평가 도구: CVE-2026-47668.py — 승인된 테스트 전용. | ---|--- CVE| CVE-2026-47668 심각도| Critical 제품| DbGate / dbgate-serve 영향받는 버전| ≤ 7.1.8 수정된 버전| ≥ 7.1.9 CVSS 3.1| AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE| CWE-20, CWE-94,...

BIT-RCLONE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-97875

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

EUVD-2026-86991

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

CVE-2026-97875

The rojo serve HTTP API (default port 34872 ) is vulnerable to DNS rebinding because it lacks Host/Origin header validation . This flaw allows a malicious webpage to access project source code, write malicious code to the local disk, and execute local programs using opener::open() without user in...

CVE-2026-97875: Reliance on Reverse DNS Resolution for a Security-Critical Action

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

PT-2026-99020

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

SUSE CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...