CVE-2026-110846 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

CVE-2026-110846

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

CVE-2026-110846 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

CVE-2026-107929

When "CURLOPTINTERFACE" or the command line tool's "--interface" option is set with one of the documented prefixes "if!", "host!", "ifhost!", that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go ou...

CVE-2025-55182

CVE-2025-55182 - React Server Components RCE Exploit Python CLI exploit for CVE-2025-55182, a critical RCE vulnerability in React Server Components via react-server-dom-webpack. Based on: ejpir/CVE-2025-55182-poc Quick Start Docker Testing Unpack src.zip zip -r src.zip src Build and run vulnerabl...

Network-Detection-Engine

version: 0.001 Network Detection Engine A lightweight 'Network Intrusion Detecion Engine' captures Live Traffic and detects real-world live attacks in real time. Zig0.15.2 . Featuress - Live packet capture using libpcap - Custom packet parsing: - Ethernet - IPv4 - TCP / UDP / ICMP - Attack...

ReconHound

ReconHound ReconHound is a Python-based web reconnaissance tool built for penetration testers, bug bounty hunters, and ethical hackers. It helps identify hidden paths, files, subdomains, query parameters, virtual hosts, and fuzzable endpoints — making it a versatile solution for deep web...

CVE-2026-67401

CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RCE Proof-of-concept for CVE-2026-67401 , a critical SQL injection vulnerability in cPanel & WHM's EmailTrack functionality that allows an authenticated user with mail-related privileges to write arbitrary files and execute code as root...

OTinstaller

OTinstaller Install, run, update, and remove open-source command line tools by name. You pick a tool from a list. OTinstaller downloads it into its own folder, runs it, and saves the output. You do not learn a different install method for each tool. otinstaller is published on PyPI version 0.0.1...

PAN-OS-CVE-2024-3400-Command-Injection-Investigation

Investigating a PAN-OS CVE-2024-3400 Command Injection Attempt Overview This project documents the investigation of a CVE-2024-3400 command injection attempt targeting a PAN-OS GlobalProtect service. The goal was to determine: whether this is a real attack whether command execution occurred wheth...

htb-ctf-walkthroughs

HTB CTF Walkthroughs Documented solutions for HackTheBox machines. Each walkthrough covers enumeration → exploitation → privilege escalation with commands, screenshots, and technical analysis. Structure htb-ctf-/ ├── index.md Full walkthrough └── media/ Screenshots and supporting files Methodolog...

CVE-2026-92247

SynaptikCMS File Manager — Authenticated RCE Vulnerability SynaptikCMS File Manager Authenticated Remote Code Execution SynaptikCMS's file manager allows an authenticated attacker to upload a file and subsequently rename it to a PHP file. This upload and rename behavior can be abused to place...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Legal disclaimer : this code is provided for educational purposes and for authorized testing only CTF, bug bounty, private lab. The author is not responsible for any illegal use. Description Krayin CRM Webkul ≤ 2.2.x exposes the...

CVE-2026-34990-poc

CVE-2026-34990: CUPS 2.4.16 local privilege escalation PoC A Python3 adaptation of the original CUPS disclosure and PoC that runs as an ordinary local user against an existing CUPS service. It demonstrates a leaked Authorization: Local token and a race that lets CUPS write a file as root. Usage...

CVE-2026-34990-poc

CVE-2026-34990 — CUPS Local unprivileged user → root , via a leaked CUPS Local authorization token and a policy-bypassing file:/// print queue. PoC by 0xcybersoldier Table of Contents Overview Vulnerability Details Affected Versions Attack Chain Requirements Installation Usage Example Run How It...

CVE-2026-100232

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute...

CVE-2026-0320

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface. The security ris...

CVE-2026-0313

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints...

CVE-2025-32432-exploit-by-P34NUT

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit Author: P34NUT2 Vulnerability: Remote Code Execution Pre-Authenticated in Craft CMS CVE: CVE-2025-32432 Target: Any vulnerable Craft CMS instance 3.x / 4.x / 5.x — tested on Hack The Box: Orion ⚠️ Disclaimer This tool is provided strictly for...

ForensiX-Studio

ForensiX Studio Forensic Intelligence Platform | Malware Analysis | Threat Correlation Engine 🧠 Multi-Signal Analysis • ⚡ Behavioral Intelligence • 🎯 MITRE Mapping ⚠️ LEGAL DISCLAIMER ForensiX Studio is intended strictly for authorized digital forensics, security research, and defensive analysis. ...