CVE-2026-14869

The CVE-2026-14869 entry documents a vulnerability in terraform-mcp-server (pre-1.1.0) where a flaw in the streamable-HTTP transport allows an unauthenticated remote attacker to trigger server-side requests that can redirect the Terraform API calls and the server-side authorization token to an at...

Security Bulletin: IBM Maximo Application Suite uses postcss-8.4.49.tgz which is vulnerable to CVE-2026-41305.

Summary IBM Maximo Application Suite uses postcss-8.4.49.tgz which is vulnerable to CVE-2026-41305. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-41305 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and...

Security Bulletin: IBM Maximo Application Suite uses dompurify-3.3.2.tgz which is vulnerable to CVE-2026-41238, CVE-2026-41239, CVE-2026-41240.

Summary IBM Maximo Application Suite uses fdompurify-3.3.2.tgz which is vulnerable to CVE-2026-41238, CVE-2026-41239, CVE-2026-41240. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-41238 DESCRIPTION: DOMPurify is a DOM-only...

Security Bulletin: IBM Maximo Application Suite uses python_dotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684.

Summary IBM Maximo Application Suite uses pythondotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a...

netwatch v0.28.0

NetWatch See what your network is actually doing — live, in your terminal. A network monitor that reads encrypted traffic, names the process behind every connection, and catches malware calling home. One binary. Zero config. Everything at once, withzero rows of chrome — no header bar, no menu bar...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299 Apache Tomcat: DoS via WebSocket chat example

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299

Apache Tomcat is vulnerable to an uncontrolled resource consumption vulnerability within its WebSocket chat example . This issue impacts versions 11.0.0-M20 through 11.0.24 , 10.1.24 through 10.1.57 , and 9.0.89 through 9.0.120 . The vulnerability can lead to a Denial of Service (DoS) . Users who...

opencode v1.18.8

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...

Security Bulletin: IBM WebSphere Application Server is affected by a privilege escalation (CVE-2026-14446)

Summary IBM WebSphere Application Server is affected by a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2026-14446 DESCRIPTION: IBM WebSphere Application Server is vulnerable to broken access control/privilege escalation in the administrative console. CWE:CWE-306: Missing...

Security Bulletin: IBM WebSphere Application Server is affected by an authentication bypass (CVE-2026-16184)

Summary IBM WebSphere Application Server is affected by an authentication bypass. Vulnerability Details CVEID:CVE-2026-16184 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. CWE:CWE-862: Missing...

LOYTEC LGATE-902 6.3.2 - Local File Inclusion Detection

LOYTEC LGATE-902 6.3.2 is susceptible to local file inclusion which could allow an attacker to manipulate path references and access files and directories including critical system files that are stored outside the root folder of the web application running on the device. This can be used to read...

Apache Struts - ShowCase Application Exposure Detection

Apache Structs ShowCase Application is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Structs ShowCase Application is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Struts - ShowCase...

Oracle Application Server test-cgi Page Detection

Detects Oracle Application Server test-cgi Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Oracle Application Server test-cgi Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle Application Server...

Sangfor Application Login - Remote Command Execution Detection

Sangfor application delivery management system login has a remote command execution vulnerability, through which an attacker can obtain server privileges and execute arbitrary commands !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor application delivery management system login has a remote...

SAP NetWeaver ICM - Detect

Detection of SAP NetWeaver ABAP Webserver or Java Application Server ICM/ICF !/usr/bin/env python3 -- coding: utf-8 -- """Detection of SAP NetWeaver ABAP Webserver or Java Application Server ICM/ICF.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Sangfor Application sys_user.conf Account Password Leakage Detection

Sangfor application delivery management system file sysuser.conf can be directly accessed without authorization, resulting in leakage of account and password !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor application delivery management system file sysuser.""" from kittysploit import from...

Generic Database File - Exposure Detection

This is collection of some web frameworks recommendation or default configuration for SQLite database file location. If this file is publicly accessible due to server misconfiguration, it could result in application data leak including users sensitive data, password hashes etc. !/usr/bin/env...

Sangfor Application download.php - Arbitary File Read Detection

There is an arbitrary file reading vulnerability in the Sangfor Application download.php. !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in the Sangfor Application download.""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Sangfor Next Gen Application Firewall - Arbitary File Read Detection

Sangfor Next Gen Application Firewall is susceptible to Local File Inclusion as it does not validate the file parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor Next Gen Application Firewall is susceptible to Local File Inclusion as it does not validate the file .""" import re from...