IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 (7281649)

The version of IBM WebSphere Application Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7281649 advisory. - IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remo...

PT-2026-65902

Name of the Vulnerable Software and Affected Versions linuxfabrik-lib versions prior to 6.0.0 Description The lib.url.fetch function follows cross-origin redirects while forwarding caller-supplied credential headers, excluding Authorization and Cookie. This behavior allows a malicious server...

CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...

CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...

CVE-2026-54638

gotd/td, a Go MTProto client, is affected by a pre-auth denial of service in proto.UnencryptedMessage.Decode where dataLen from an unauthenticated MTProto unencrypted packet could trigger unbounded memory allocation before validating the buffer. This could cause excessive memory usage and CPU/GC ...

CVE-2026-66064 goshs has ACL Bypass & Path Traversal

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...

GHSA-2RX5-2G7J-2659 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...

CVE-2026-16771

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...

SUSE CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-61609

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

CVE-2026-64642

A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerability allows for unauthorized access, leading to a high...

SUSE-SU-2026:3366-1 Security update for samba

This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-byt...

Huawei Auth Http Server - Arbitrary File Read Detection

Huawei Auth HTTP Server is vulnerable to Arbitrary File Read. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Auth HTTP Server is vulnerable to Arbitrary File Read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

Agentejo Cockpit <0.12.0 - NoSQL Injection Detection

Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form. !/usr/bin/env python3 -- coding: utf-8 -- """Agentejo Cockpit prior to 0.""" import re from kittysploit import fro...

txAdmin Panel - Detect

txAdmin panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """txAdmin panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'txAdmin Panel - Detect', 'description': 'txAdmin panel was...

Discourse OAuth Social Login - Cross-site Scripting

Discourse ", for path in paths...

GoCD Login Panel - Detect

GoCD login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GoCD login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GoCD Login Panel - Detect', 'description': 'GoCD login panel...

Mixpost Auth Login - Panel Detect

Mixpost authentication interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Mixpost authentication interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mixpost Auth Login - Pane...

Basic Auth Detection

Detects Basic Auth Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Basic Auth Detection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Basic Auth Detection', 'description': 'Detects Basic...

WP Cerber < 8.9.3 - Broken Access Control Detection

WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints, exploit requires sending a request with a trailing '?'. !/usr/bin/env python3 -- coding: utf-8 -- """WP Cerber 8."""...