Linux Distros Unpatched Vulnerability : CVE-2026-91992

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state...

Linux Distros Unpatched Vulnerability : CVE-2024-58384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request...

Linux Distros Unpatched Vulnerability : CVE-2026-90848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a...

Linux Distros Unpatched Vulnerability : CVE-2026-85234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass...

SUSE SLED15: libzypp / libzypp-devel / zypper / zypper-log / etc (SUSE-SU-2026:4112-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4112-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625....

Linux Distros Unpatched Vulnerability : CVE-2026-90830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function bfdwritemergedsection of the file bfd/merge.c of the component Section...

Linux Distros Unpatched Vulnerability : CVE-2026-84445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to...

Linux Distros Unpatched Vulnerability : CVE-2026-79705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can...

Linux Distros Unpatched Vulnerability : CVE-2026-92000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft...

Linux Distros Unpatched Vulnerability : CVE-2026-91962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can...

cormem-read-poc

DISCLAIMER : This project is for educational and security research purposes only. Use only on systems you own or have explicit permission to test. Unauthorized use may be illegal in your jurisdiction. cordrvexploit — CVE-2026-38194 Vulnerability This tool demonstrates CVE-2026-38194, a...

tesla-security-research

Tesla Security Research Vulnerability research on the Tesla Model 3/Y infotainment system Intel Atom MCU, Linux 4.14.235, responsibly disclosed to Tesla via Bugcrowd. Obtained persistent root access on a production Tesla Model 3 through a command injection vulnerability in Tesla's ODIN diagnostic...

CVE-2026-63030

CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated detection and exploitation tool for the WordPress core batch-confusion vulnerability CVE-2026-63030 / CVE-2026-60137, which leads to SQL injection and remote code execution RCE through the REST API batch endpoint. ⚠️ For authorized...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

kern

kern: a fast, rootless sandbox and virtual resource runtime. Run any workload in a real container, including an agent's tool-call or LLM-generated code. A real, kernel-enforced container in 3.5 ms, out of one static binary with no daemon. 0 RAM at rest · no daemon, no socket, nothing to start · o...

impostor

Impostor NTLMv2 해시를 가로채기 위한 SMB1 서버로, C 언어로 작성되었습니다. 이 프로젝트의 목표는 상태 머신으로서 SMB1 서버를 구현하여 클라이언트의 요청을 올바르게 수락하고 응답함으로써 클라이언트를 속여 NTLM 인증을 완료하게 하고, 이를 통해 클라이언트 자신의 NTLMv2 해시hashcat/john과 호환되는 형식를 노출시키는 것입니다. 공격적 보안/레드팀 활동 및 교육 목적SMB1/NTLM 프로토콜 연구을 위한 도구로, 소유한 환경 또는 명시적 동의가 있는 환경에서만 독점적으로 사용해야 합니다. 작동...

CVE-2026-62735

CVE-2026-62735 Information This vulnerability was originally discovered by Siyeon Wi. I reproduced the vulnerability independently for educational and case-study purposes. The vulnerability was also demonstrated at Pwn2Own Berlin 2026. References: TrendAI Zero Day Initiative status TrendAI Zero D...

gradient-untangler

gradient-untangler A local research harness that searches for the exact tokens that make an open-weight language model start its answer the way you specify. Open-weight models ship as ordinary files: config.json, a tokenizer, and one or more .safetensors or .bin shards. A Hugging Face id is only ...

impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

CVE-2026-76081

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...