next88

next88 - React Server Components RCE Scanner High-performance Go implementation for detecting React Server Components RCE vulnerabilities CVE-2025-55182 & CVE-2025-66478. Features 🚀 High Performance : Compiled Go binary with goroutine-based concurrency 🔍 Multiple Detection Methods : Safe...

retbleed-speculative-execution-poc

Retbleed：通过 RSB 下溢实现任意推测性代码执行 对 Retbleed（CVE-2022-29900 / CVE-2022-29901） 的动手复现——这是 2022 年的微架构攻击，它打破了“Retpoline”防御，证明了长期以来被认为安全的 ret 指令在 CPU 的返回栈缓冲区（RSB）下溢时可以被劫持。 本项目在 gem5 中的 x86 乱序 CPU 模型上模拟完整的攻击生命周期：触发 RSB 下溢，通过 Flush+Reload 缓存侧信道逐字节泄露机密数据，然后验证一种关闭该泄露的软件缓解措施（lfence）。 课程项目——高级计算机体系结构，2025...

CVE-2026-68513

A flaw was found in PyOpenEXR, a component of OpenEXR. A heap buffer overflow can occur when processing a specially crafted EXR image file. This vulnerability is triggered by a channel-name key collision between literal and prefixed RGB channels, causing the software to write data beyond the...

I-know-where-your-page-lives

I-know-where-your-page-lives I Know Where Your Page Lives: Derandomizing the latest Windows 10 Kernel - ZeroNights 2016 Requirements Intel Processor Haswell or newer Windows 10 x64 Usage Run ASLRSideChannelAttack.exe to get the PML4-Self-Ref entry root@kitploit:...

CVE-2026-77568

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...

CVE-2026-77568 Mojolicious: CSRF tokens are vulnerable to BREACH attacks

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...

react2shell-evolved

React2Shell Scanner High Fidelity Detection for RSC/Next.js RCE Scanner for detecting Remote Code Execution RCE vulnerabilities in React Server Components and Next.js applications. About React2Shell Scanner is a specialized tool for identifying Remote Code Execution RCE vulnerabilities in...

CVE-2026-10027

IBM MQ queue manager (versions 9.1.0.0 through 10.0.0.0) and IBM MQ Appliance (9.4 LTS/CD and 10.0) are vulnerable to an unauthenticated remote code execution flaw caused by a heap out-of-bounds write (CWE-787) in the message decompression handler. A remote attacker with network access to the lis...

cve-2025-32433

Erlang/OTP SSH Unauthenticated Blind RCE CVE-2025-32433 PoC 📜 Description CVE-2025-32433 is a critical unauthenticated remote code execution vulnerability in Erlang/OTP's SSH server. Prior to the patched versions, the SSH daemon incorrectly processes channel messages before authentication is...

prefetch-tool

Herramienta de Prefetch KASLR para Windows Una herramienta de prueba de concepto para evadir KASLR ASLR del kernel en Windows 11. Inspirada en EntryBleed para Linux. Esta herramienta fue desarrollada como parte de un exploit dirigido a Windows 11 24H2. No soy un experto en canales laterales en...

CVE-2026-23006-Kyber-Ciphertext-Length-Side-Channel

CVE-2026-23006 – Kyber Ciphertext Length Side‑Channel Program Code Python root@kitploit: kyberlengthleak.py - Leaks secret key bit based on ciphertext length import random Simulate encapsulation: ciphertext length depends on message bit def encapsulatepk, bit: In a flawed implementation, the...

telegram_bbbot

telegrambbbot Telegram Bug Bounty Bot https://telegram.me/bugbountychannel History This bot adopted special for deploying to Heroku General purposes of this got - "Be helpful for infosec community!" Bot use https://github.com/maddevsio/bbcrawler for fetching information Used heroku...

dnscat2-powershell

dnscat2 is a DNS covert channel tool by @iagox86 Ron Bowes which is used to transfer data over DNS requests. This is a powershell version of the dnscat2 C client. Click here for a blog post that gives a more detailed breakdown of the purpose of this script, and how to use it. To use this script,...

CVE-2025-6792

エクスプロイト: 不正なPusherチャンネル購読 盗聴 1 Pusher認証情報の取得 ブラウザコンソールから root@kitploit: console.log window.wpguppyscriptsvars.pusherKey, window.wpguppyscriptsvars.pusherCluster ; 2 被害者のプライベートチャンネルを購読 root@kitploit: Pusher Eavesdrop Test Listening on private-user-5 const log = msg = const p =...

Linux Distros Unpatched Vulnerability : CVE-2026-93089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: armscmi: Free transport channel on IDR failure If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the...

Linux Distros Unpatched Vulnerability : CVE-2026-93194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/rockchip: dwdp: Release core resources Core resources such as the DisplayPort AUX channel get initialized and registered during dwdpbind, but are never...

Linux Distros Unpatched Vulnerability : CVE-2026-90110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on t...

Linux Distros Unpatched Vulnerability : CVE-2026-93040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update t...

Linux Distros Unpatched Vulnerability : CVE-2026-93082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: armscmi: Unwind P2A receiver mailbox setup failure mailboxchansetup can request an additional P2A receiver channel after successfully acquiring the...

Linux Distros Unpatched Vulnerability : CVE-2026-93195

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel The DisplayPort AUX channel gets initialized and registered during dwdpbind, but it is never...