CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...

CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...

CVE-2026-54638

gotd/td, a Go MTProto client, is affected by a pre-auth denial of service in proto.UnencryptedMessage.Decode where dataLen from an unauthenticated MTProto unencrypted packet could trigger unbounded memory allocation before validating the buffer. This could cause excessive memory usage and CPU/GC ...

CVE-2026-66064 goshs has ACL Bypass & Path Traversal

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...

GHSA-2RX5-2G7J-2659 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...

CVE-2026-16771

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...

SUSE CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-61609

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

CVE-2026-64642

A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerability allows for unauthorized access, leading to a high...

SUSE-SU-2026:3366-1 Security update for samba

This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-byt...

Huawei Auth Http Server - Arbitrary File Read Detection

Huawei Auth HTTP Server is vulnerable to Arbitrary File Read. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Auth HTTP Server is vulnerable to Arbitrary File Read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

Loan Management System 1.0 - SQL Injection

Auth bypass SQLi via username on /ajax.php?action=login. !/usr/bin/env python3 -- coding: utf-8 -- """Loan Management System 1.0 - SQL Injection""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Loan...

Rancher - Incomplete Setup Exposure Detection

Detected Rancher installation was found with an incomplete first-time setup. The bootstrap login page was publicly accessible at /dashboard/auth/login, indicating an unconfigured instance that could have been targeted for unauthorized setup completion. !/usr/bin/env python3 -- coding: utf-8 --...

Airflow Experimental <1.10.11 - REST API Auth Bypass Detection

Airflow's Experimental API prior 1.10.11 allows all API requests without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Airflow's Experimental API prior 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

SaltStack Salt <3002.5 - Auth Bypass Detection

SaltStack Salt before 3002.5 does not honor eauth credentials for the wheelasync client, allowing attackers to remotely run any wheel modules on the master. !/usr/bin/env python3 -- coding: utf-8 -- """SaltStack Salt before 3002.""" from kittysploit import from lib.protocols.http.httpclient impor...

WP Cerber < 8.9.3 - Broken Access Control Detection

WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints, exploit requires sending a request with a trailing '?'. !/usr/bin/env python3 -- coding: utf-8 -- """WP Cerber 8."""...

Reprise License Manager 14.2 - Authentication Bypass Detection

Reprise License Manager RLM 14.2 does not verify authentication or authorization and allows unauthenticated users to change the password of any existing user. !/usr/bin/env python3 -- coding: utf-8 -- """Reprise License Manager RLM 14.""" from kittysploit import from lib.protocols.http.httpclient...

VoipMonitor - Pre-Auth SQL Injection Detection

A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level. !/usr/bin/env python3 -- coding: utf-8 -- """A SQL injection vulnerability in Voipmonitor GUI before v24.""" from kittysploit import from lib.protocols.http.httpclien...

Samsung WLAN AP WEA453e - Remote Code Execution Detection

Samsung WLAN AP WEA453e is vulnerable to a pre-auth root remote command execution vulnerability, which means an attacker could run code as root remotely without logging in. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e is vulnerable to a pre-auth root remote command executi...

Etherpad Lite <1.6.4 - Admin Authentication Bypass Detection

Etherpad Lite before 1.6.4 is exploitable for admin access. !/usr/bin/env python3 -- coding: utf-8 -- """Etherpad Lite before 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Etherpad Lite 1.6.4 - Admin...