TLS-Scanner

TLS-Scanner TLS-Scanner es una herramienta para ayudar a pentesters e investigadores de seguridad en la evaluación de configuraciones de servidores y clientes TLS. Tenga en cuenta: TLS-Scanner es una herramienta de investigación destinada a desarrolladores TLS, pentesters, administradores e...

How-To-Secure-A-Linux-Server

如何保护 Linux 服务器 一份持续更新的 Linux 服务器安全加固指南，同时也希望能让你了解一些安全知识及其重要性。 目录 引言 指南目标 为什么要保护你的服务器 为什么又出一份指南 其他指南 待办/待添加 指南概述 关于本指南 我的使用场景 编辑配置文件——给懒人看的 贡献 开始之前 明确你的原则 选择 Linux 发行版 安装 Linux 安装前/后的要求 其他重要说明 使用 Ansible 剧本保护你的 Linux 服务器 SSH 服务器...

CVE-2023-22515-NSE

CVE-2023-22515-NSE Este repositorio proporciona una herramienta para verificar la presencia de la vulnerabilidad CVE-2023-22515 en Atlassian Confluence Server utilizando el Motor de Scripting de Nmap NSE. Resumen de CVE-2023-22515 CVE-2023-22515 es una vulnerabilidad crítica en Atlassian Confluen...

CVE-2025-55182

CVE-2025-55182 概念验证 本仓库包含针对 CVE-2025-55182 的概念验证 POC，展示了该漏洞及其利用方法。 弱服务器 root@kitploit: "dependencies": "next": "16.0.6", "react": "19.2.0", "react-dom": "19.2.0" , 弱服务器 2 root@kitploit: "dependencies": "next": "^15.0.0", "react": "^19.0.0", "react-dom": "^19.0.0" ,...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...

CVE-2026-79748 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

EUVD-2026-42400

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading and weakly via $ENV username substitution...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...

CVE-2026-75845

ArcadeDB 26.4.2–26.7.3's SetServerSettingTool.execute() checks only the global allowAdmin flag without verifying the caller's role, letting authenticated read-only users modify GlobalConfiguration in MCP deployments. CVSS 6.3 (MEDIUM); no exploitation observed. Fixed in 26.8.1.{

EUVD-2026-56861

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

CVE-2026-23744 – MCPJam Inspector Unauthenticated RCE PoC...

postfix: buffer over-read via malformed enhanced status code

A flaw was found in Postfix. This issue occurs when processing enhanced status codes, specifically an enhanced status code that lacks text following the third number. Depending on the configuration of the server, this allows a remote attacker to cause a buffer over-read of only 1 byte, leading to...

CVE-2026-9077

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...

EUVD-2026-53478

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations...

EUVD-2026-53114

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

CVE-2026-70619 Odysseus Missing Admin Authorization via Embedding Endpoint Routes

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

CVE-2026-11770

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

UBUNTU-CVE-2026-11770

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...