VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

CVE-2018-7600

POC of CVE-2018-7600 Drupal RCE CVE-2018-7600 Dont Forget to Put Your Adress into the Script ! Description: A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which...

cve-2025-29927

CVE-2025-29927 1. go to /api/flag 2. add x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware as header 3. see response...

matrix-rs

Windows Kernel Blue Pill Type-2 Hypervisor in Rust Codename: Matrix Blog: https://memn0ps.github.io/hypervisors-for-memory-introspection-and-reverse-engineering/ A lightweight, memory-safe, and blazingly fast Rust-based type-2 research hypervisor with hooks for Intel VT-x, focused on studying the...

cve-2026-19900-PoC

CVE-2026-19900 LB-LINK X-PRO Omisión de Autenticación y RCE mediante usuario nulo CVE-2026-19900 Credenciales fijas y omisión de autenticación RCE mediante usuario nulo. Omisión mediante cabecera: Cookie:user=null Uso Compila y ejecuta el script con un host objetivo: root@kitploit: go build...

Vlun-Agent-X

VulnAgent-X Research Prototype VulnAgent-X is a research-focused multi-agent prototype for bug and vulnerability detection. It takes a local repository or diff as input, and outputs structured findings, evidence chains, localization, confidence, and experiment logs. Core Capabilities Inputs: repo...

CVE-2024-27518

CVE-2024-27518 - SUPERAntiSpyware Professional X LPE PoC This vulnerability was discovered and disclosed by M. Akil Gündoğan from Secunnix Vulnerability Research Team. This repository will hold the proof-of concept and advisories. Details: Product: SUPERAntiSpyware Professional X and all editions...

CVE-2026-32641

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

CVE-2026-32641 Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

CVE-2026-32641 Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

CVE-2026-32641 Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

CVE-2026-32641

Parseable , a log analytics platform for high-volume data ingestion, is affected by an unauthenticated denial-of-service vulnerability in versions prior to 3.0.0 . The root cause is an unchecked unwrap() call in src/handlers/http/middleware.rs while parsing the x-amz-firehose-common-attributes he...

EUVD-2026-83265

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

tpwn

tpwn cve-2015-???? poc os x 10.10.5 kernel local privilege escalation vulnerability got burned in 10.11 full writeup etason shout out @ unthreadedjb 4 hax Install NULLGuard to protect yourself against tpwn and other NULL Pointer Deference bugs...

GHSA-C8W2-FGVX-VHV4 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...

CVE-2026-61682

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...

CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...

CVE-2026-61682

kcp is a Kubernetes-like control plane. Prior to 0.31.4 and 0.32.2 , the kcp front-proxy does not strip inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. An authenticated tenant can inject headers such as X-Remote-Group: system:maste...

EUVD-2026-83043

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...