Blackash-CVE-2025-53770

🧠 CVE-2025-53770：严重 SharePoint RCE 漏洞利用 ViewState 伪造实现远程代码执行 📌 漏洞概述 类型 : 远程代码执行（RCE） CVSS 评分 : 9.8（严重） 组件 : Microsoft SharePoint Server（本地部署） 根本原因 : 使用窃取的 ASP.NET machineKey（ValidationKey 和 DecryptionKey）对 ViewState 数据进行不安全反序列化 利用条件 : 无需身份验证 状态 : 已在野外被积极利用 披露日期 : 2025年7月19日 发现/报告方 : 多家安全厂商及政府应急响应...

cve-2025-64446-fortiweb-exploit

CVE-2025-64446 Fortinet FortiWeb 路径遍历远程代码执行漏洞利用工具 一款用于检测和测试 Fortinet FortiWeb Web 应用防火墙 WAF 中 CVE-2025-64446 漏洞的安全研究工具。此严重零日路径遍历漏洞已在野外被积极利用，允许未经身份验证的攻击者绕过安全控制并执行任意代码。 ⚠️ 免责声明 此工具仅用于授权的安全测试和教育目的 。未经授权访问计算机系统是违法的。请仅在你拥有或已获得明确书面许可的系统上使用此工具。 📋 概述 CVE-2025-64446 是 Fortinet FortiWeb WAF...

CVE-2025-61882-POC

Herramienta de pruebas de seguridad CVE-2025-61882 🚨 ADVERTENCIA LEGAL CRÍTICA Consulta nuestra publicación en el blog para obtener detalles técnicos ESTA HERRAMIENTA ES SOLO PARA PRUEBAS DE SEGURIDAD AUTORIZADAS root@kitploit: ╔══════════════════════════════════════════════════════════════╗ ║ ║ ...

blackash-cve-2025-6389

🔥 CVE-2025-6389 — 严重 WordPress 零日漏洞（远程代码执行） wpvultheme 🧩 这是什么？ CVE-2025-6389 是一个 严重（CVSS 9.8） 漏洞，存在于被流行主题广泛使用的 Sneeit Framework WordPress 插件（≤ 8.3）中。 它允许 未认证远程代码执行 —— 这是最危险的 Web 漏洞类型。 ⚠️ 严重性与影响 🔓 无需登录 💥 可能完全接管服务器 📤 攻击者可上传 shell、添加管理员用户或修改主题/插件文件 🧬 已在野外 被积极利用 🎯 影响任何使用 Sneeit Framework 或捆绑了该框架的主题（例如...

gitlab-cve-2026-85706-ioc

CVE-2026-85706 — Escáner de IOC y Kit de Detección para Path Traversal en GitLab Path Traversal No Autenticado en la API de Commits de Repositorio de GitLab CE/EE CVSS 3.1: 10.0, Crítico Estado: Explotado activamente en el wild · Incluido en CISA KEV 2026-09-11, vence 2026-09-14 · Parcheado por...

Exploit for CVE-2026-85706

CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection...

CVE-2025-47812

CVE-2025-47812 ¿Cómo funciona este método de detección? Esta plantilla de Nuclei detecta instancias de Wing FTP Server vulnerables a CVE-2025-47812 mediante la identificación de versiones anteriores a la 7.4.4 expuestas en la respuesta HTML del cliente web. ¿Cómo ejecuto este script? 1. Descargue...

POC-CVE-2026-56164-exploit

CVE-2026-56164 — Exploit de omisión de autenticación en Microsoft SharePoint Server Crítico CVSS 9.8 — Escalada de privilegios no autenticada a Administrador de granja en Microsoft SharePoint Server Tabla de contenidos Descripción general Detalles de la vulnerabilidad Versiones afectadas Diagrama...

Update Chrome now to protect against an actively exploited vulnerability

Chrome is rolling out an update for its desktop browser. The update includes 230 security fixes, one of which is known to be actively exploited. The stable channel has been updated to 153.0.8010.36/.37 for Windows and Mac, and 153.0.8010.36 for Linux. How to update Chrome If you don’t want to wai...

Vulnerability handling in Google Chrome

Google has discovered a vulnerability in the V8 JavaScript engine of Google Chrome. Google reports that this vulnerability is actively exploited with the identifier CVE-2026-87491. It involves an out-of-bounds write operation in the V8 engine of Google Chrome, which occurs in versions prior to...

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Google on Tuesday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 CVSS score: N/A, has been described as an out-of-bounds bug in V8, Chrome's...

CVE-2026-81963

creationtimestamp| type| source ---|---|--- 2026-09-08 17:25:21+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117236585017342705 2026-09-08 18:09:10+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3muzmkt3whi2t 2026-09-08 18:19:20+00:00| seen|...

CVE-2026-86060

creationtimestamp| type| source ---|---|--- 2026-09-05 20:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muse5uamk62w 2026-09-05 21:41:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7hz5v6cd2tn4v 2026-09-05 22:00:02+00:00| exploited|...

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 CVSS score: 8.8, has been described as a type confusion bug in V8, Chrome's JavaScript and...

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

Overview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution RCE ...

CVE-2026-5153

creationtimestamp| type| source ---|---|--- 2026-09-02 10:00:30+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2026-09-01 2026-09-02 11:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7b4ab454-d7da-47b7-8de3-083f9b71d5a8 2026-09-03...

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 CVSS score: 9.8, a case of remote code execution that allows an...

CVE-2026-77136

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

CVE-2026-77136 Server-Side Template Injection in extension "powermail" (powermail)

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

EUVD-2026-65340

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...