CVE-2026-72582: NULL Pointer Dereference

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

CVE-2026-72588: Observable Response Discrepancy

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

PT-2026-69556

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in libceph where ceph x create authorizer caches the iov base and iov len of the authorizer buffer within the ceph auth handshake structure. When ceph x update authorizer...

PT-2026-69720

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the sctp auth ep add chunkid function uses an incorrect capacity limit for the ep-auth chunk list. While the limit is set to 20 entries,...

PT-2026-69776

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the auth hmacs array within struct sctp cookie is incorrectly sized. The array is intended to store a complete SCTP AUTH HMAC ALGO...

PT-2026-69466

Name of the Vulnerable Software and Affected Versions fastschema versions prior to 0.15.2 Description A NULL pointer dereference occurs when the server fails to validate that a pointer is non-nil before use. An unauthenticated remote attacker can trigger a fatal panic that crashes the server...

Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

Exploit Title: Joomla 2.9.99.4 -Unauthenticated Remote Code Execution Date: 2026-07-10 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.joomla.org/ Software Link: https://extensions.joomla.org/extension/jce/ Version: JCE 1.0.0 through 2.9.99.4 fixed in 2.9.99.5 Tested on: Jooml...

ownsite-assessor

OwnSite Assessor Authorized defensive security assessment...

Linux Distros Unpatched Vulnerability : CVE-2026-19017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA...

Magic Link / Passwordless Auth Surface Detection

Probes common magic-link and passwordless paths NextAuth, custom APIs for exposed email submission endpoints and sign-in link flows. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed magic link and passwordless authentication endpoints.""" from kittysploit import from...

WebSocket / SSE Auth Probe

Tests Socket.io polling transports, SSE streams, and realtime paths for unauthenticated access, open CORS, and missing Origin enforcement. !/usr/bin/env python3 -- coding: utf-8 -- """Probe WebSocket Socket.io and SSE endpoints for weak auth and Origin checks.""" from kittysploit import from...

BASM (Broken Authentication & Session Management) Apache Tomcat Dependency in Jira Software Data Center and Server

This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk This Critical severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-53434 was introduced in 9.12.13 and...

WordPress Core XSS2Shell RCE (CVE-2026-64638)

Exploits CVE-2026-64638 in WordPress Core 4.7.0 through 7.0.2: a striptags/KSES parser differential on /wp-login.php injects live DOM id=ajaxurl clobber. Default mode confirms the unauthenticated XSS primitive. With SERVE=true, hosts the full chain Application Password theft - REST - plugin uploa...

LiteLLM Pre-Auth Blind SQLi (CVE-2026-42208)

CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: the proxy virtual-key lookup builds SQL with WHERE v.token = 'token' and interpolates the raw bearer from failed auth logging. Inject via Authorization on LLM routes must NOT start with sk-. Calibrates timing, confirms pgsleep scales, th...

OpenCTI Auth Bypass (CVE-2026-27960)

CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The compile-time admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f authenticates as admin on every deployment. !/usr/bin/env python3 -- coding:...

LiteLLM CVE-2026-42208 Blind SQLi Detect

Detects CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: failed-auth logging passes the raw Authorization bearer into a virtual-key SQL lookup. Probes POST /v1/chat/completions with x'-prefixed pgsleep payloads never sk- and requires delay scaling plus a fast sk- control to rule out...

SiYuan CVE-2026-66012 MCP Auth Bypass Detect

Detects CVE-2026-66012 in SiYuan kernel 3.7.0 = v 3.7.2: POST /mcp on the Publish port default 6808 accepts anonymous RoleReader JWTs when Publish auth is disabled, exposing MCP tools including workspace file read without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SiYuan...

osTicket Reset Token Auth Bypass (CVE-2026-18363)

CVE-2026-18363 in osTicket 1.17.8 and 1.18.0–1.18.3: password reset tokens are accepted forever because the expiry gate in PasswordResetTokenBackend::signOn never runs for existing tokens. POST the victim's reset token to /scp/pwreset.php to obtain an authenticated agent session; optionally set a...

OpenCTI CVE-2026-27960 Auth Bypass Detect

Detects CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f is identical across deployments and authenticates as admin when sent as a bearer...

Snipe-IT CVE-2026-37709 File Upload Detect

Detects CVE-2026-37709 in Snipe-IT ≤ 8.4.0 fixed in 8.4.1: POST /api/v1/objecttype/id/files checks the view permission instead of update, so any API user with view-only access can upload files to visible objects. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Snipe-IT CVE-2026-37709 view-onl...