RIPPL

RIPPL Manipulating PPL protected processes without using a driver This tool implements a userland exploit to manipulate Windows PPL protected processes. The technique was initially discussed by James Forshaw a.k.a. @tiraniddo and Clément Labro a.k.a. @itm4n in the following blogposts. Blog post...

CVE-2025-21298

CVE-2025-21298 content This is a proof-of-concept for CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability CVSS 9.8. This is a memory corruption PoC , not an exploit. vulnerability The vulnerability is located in ole32.dll!UtOlePresStmToContentsStm. The purpose of the function is ti...

blackpill

BlackPill BlackPill is a stealthy Linux rootkit made in Rust. Features The rootkit is composed of multiple modules talking about Rust modules, not kernel modules: defense evasion : hide files, processes, network connections, etc. hooking : hook syscalls and IDT hypervisor : create a virtual machi...

EUVD-2026-109207

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads...

EUVD-2026-109192

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hiddendim/classnum results in out-of-bounds read...

DVS

DCOM Vulnerability Scanner AKA Devious swiss army knife - Lateral movement using DCOM Objects Did you ever wonder how you can move laterally through internal networks? or interact with remote machines without alerting EDRs? Let's assume that we have a valid credentials, or an active session with...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

lazyCSRF

LazyCSRF LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite. No longer maintenance🙇 When I started developing lazyCSRF, I mistakenly thought that the CSRF PoC generator built into Burp Professional could not generate PoC using XHR and did not support PUT requests, etc. I am stil...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

VehApiResolve

VehApiResolve Inspired by Dridex Loader's 32 bit API obfuscation. How does this work? We setup an exception handler. AddVectoredExceptionHandler CALLFIRST, ApiResolverHandler ; This exception handler will only handle exception's thrown as EXCEPTIONBREAKPOINT. When it is thrown by us, we're able t...

Flowise 3.1.2 NodeVM Sandbox Escape

Flowise versions through 3.1.2 contain a NodeVM sandbox override that lets authenticated custom-function users re-enable blocked Node.js modules and execute arbitrary system commands. Version 3.1.3 fixes the issue...

PT-2026-122495

Name of the Vulnerable Software and Affected Versions Prime Mover versions prior to 2.2.2 Description An unauthenticated attacker can perform PHP Object Injection by submitting a crafted, base64-encoded serialized object through the standard comment-submission endpoint 'wp-comments-post.php', whi...

PT-2026-122667

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.4 Description Cross site scripting is possible in the Rack Link Creation component via the create rack link function within the app/tools/racks/show-rack-popup.php file. This occurs when the deviceid argument is...

PT-2026-122595

Name of the Vulnerable Software and Affected Versions open62541 versions 1.5.0 through 1.5.6 Description An integer overflow exists in the UA DataType fromStructureDescription function that affects the 16-bit memSize field when processing large custom structure definitions. A malicious OPC UA...

PT-2026-122515

A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed...

PT-2026-122656

A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and...

PT-2026-122664

A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. Th...

Important: python3.14

Issue Overview: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. CVE-2026-15310 The HTTPPasswordMgr class in the urllib.request module, along with its...

Important: wireshark

Issue Overview: TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service CVE-2026-95386 The spdyassembledataframes function in epan/dissectors/packet-spdy.c accumulates SPDY DATA frame payload fragment lengths into a uint32t variable named datalen without any overflow protection...

Medium: libsoup3

Issue Overview: A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection...