cua-kit

CUA-Kit A toolkit for enumerating and interacting with computer use agents on Windows and macOS systems. Tools Tool| Description| Outputs ---|---|--- cua-enum| Enumerate computer use agent configurations Claude Code, Codex CLI, Cursor, Gemini CLI| .exe, .x64.o cua-exec| Execute computer use agent...

CVE-2026-41940-POC

CVE-2026-41940 – cPanel/WHM Authentication Bypass PoC This repository contains a proof-of-concept PoC exploit for CVE-2026-41940, demonstrating a multi-step authentication bypass in cPanel/WHM via CRLF injection and session poisoning. Disclaimer: This code is for educational and authorized securi...

CVE-2025-32432

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit for unauthenticated remote code execution in Craft CMS, written in Go. Inspired by the original work of c0gnit00. How it works 1. Gets the PHP session and CSRF token via GET /admin/login 2. Poisons the PHP session file by injecting PHP code into the...

CVE-2026-41940-Exploit-PoC

CVE-2026-41940 Exploit PoC – cPanel & WHM Authentication Bypass Tool by: Ishan Oshada | GitHub ⚠️ FOR AUTHORIZED SECURITY TESTING ONLY. Unauthorized use is illegal. 📋 Table of Contents Vulnerability Overview Exploit Chain Features Installation Quick Start Usage Examples Post-Exploit Actions...

CVE-2026-67431 MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that...

SUSE CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-48847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

DEBIAN-CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

UBUNTU-CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

CVE-2026-48847

Roundcube Webmail is affected in versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue allows pre-authentication arbitrary file deletion via Redis/Memcache session poisoning bypass. The CVE notes a low-severity impact (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) with exploitation possible over ...

EUVD-2026-31724

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

CVE-2026-48847

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass...

PT-2026-43110

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.x through 1.6.15 Roundcube Webmail versions 1.7.x through 1.7.0 Description An issue allows pre-authentication arbitrary file deletion through a session poisoning bypass when using redis or memcache. Session...

Craft CMS 5.6.16 - RCE

Exploit Title: Craft CMS 5.6.16 - RCE Google Dork: N/A Date: 2026-01-24 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Vendor Homepage: https://craftcms.com Software Link: https://github.com/craftcms/cms Version: = 3.9.14, = 4.14.14, = 5.6.16 Tested on: Linux, Apache/Nginx, PHP 8...

CVE-2025-60799

phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters 'subject', 'server', 'database', 'queryid' without proper validation or access...