CVE-2026-76861 Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntoolstcpdumpstartset.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code...

CVE-2026-22008-AWS-Lambda-Layer-Injection-via-Shared-Layer-ARN

CVE-2026-22008 – 通过共享 Layer ARN 的 AWS Lambda Layer 注入 程序代码 Python root@kitploit: deployvulnerablelambda.py - Lambda function using a layer from untrusted account import boto3 lambdaclient = boto3.client'lambda' Attacker publishes a public layer containing malicious code Victim function references...

GitLab-CVE-2021-22205-

脆弱性の影響 GitLab CE/EE において、バージョン11.9以降のすべてのバージョンに影響する問題が発見されました。GitLab はファイルパーサーに渡された画像ファイルを適切に検証しておらず、リモートコマンド実行が発生していました。 影響を受けるバージョン Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 脆弱性の影響 近日公開... 参考 https://github.com/mr-r3bot/Gitlab-CVE-2021-22205...

log4shell-vulnerable-app

存在漏洞的应用程序 本仓库包含一个存在 CVE-2021-44228 漏洞的 Spring Boot Web 应用程序，该漏洞被称为 log4shell。 该应用使用了： log-4j-core:2.14.1（通过 spring-boot-starter-log4j2） openjdk:8u181 运行应用 启动应用： root@kitploit: docker run --name vulnerable-app --rm -p 8080:8080 romanutti/log4shell-vulnerable-app 或者自行构建： root@kitploit: docker build...

CVE-2026-59243_exploit

CVE-2026-59243 — Apache Airflow FAB Provider OAuth 认证绕过 → DAG RCE 在 Apache Airflow 的 FAB auth-manager provider（apache-airflow-providers-fab）中存在认证绕过，可通过触发的 DAG 实现远程代码执行。 该提供程序默认在禁用签名验证的情况下解码 Azure OAuthidtoken（airflow/providers/fab/authmanager/securitymanager/override.py，decodeandvalidateazurejwt）...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — PoC de CVE-2026-43499 kernel 4.19 de Qualcomm Escalada de privilegios local que explota CVE-2026-43499 — un bug en removewaiter de rtmutex que deja un struct rtmutexwaiter colgando en la pila del kernel del waiter kernel/locking/rtmutex.c, use-after-free CWE-416. Adaptado de...

VMware_vCenter_CVE-2021-21972

VMwarevCenterCVE-2021-21972 VMware vCenter CVE-2021-21972 相关工具 Invoke-CVE-2021-21972-Scan.ps1 此脚本将扫描指定的目标主机，并尝试检测哪些主机易受 VMware vCenter CVE-2021-21972 漏洞影响。 脚本将按以下顺序执行： 创建一个日志文件，默认日志名为 Invoke-CVE-2021-21972-Scan-output.txt 通过执行以下步骤扫描每个目标主机： 检查根域名中是否包含 vSphere/vCenter 字符串 若未找到，则检查 /ui/ HTML5 UI...

cve-2021-3449

CVE-2021-3449 OpenSSL 该问题于 2021 年 3 月 17 日由诺基亚报告给 OpenSSL。修复由 Peter Kästle 和 Samuel Sapalski（诺基亚）开发。 缓解措施 已知的唯一修复方法是更新 libssl1.1。 即使某些应用默认使用强化 TLS 配置禁用了 TLS 重新协商， 如果它们运行在旧版 OpenSSL 上，仍然会受到此漏洞的影响。 利用代码 main.go 是一个小巧的脚本，它连接到一个 TLS 服务器，强制重新协商，然后断开连接。 利用代码被注入到 Go 1.14.15 捆绑的 encoding/tls 包中。 你可以在...

CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666 – XPC 服务 NSKeyedUnarchiver 反序列化攻击（macOS/iOS 模拟） 程序代码（Python 模拟） root@kitploit: !/usr/bin/env python3 vulnerablexpcservice.py - Simulated XPC service using unsafe plist deserialization import plistlib, subprocess, socketserver, struct Mach message simulation: we just accept a binary...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Probado contra VMware VCSA 6.7 crear par de claves ssh root@kitploit: ssh-keygen -t rsa -f vcsa.key -N '' crear tarball con ../../../../../home/vsphere-ui/.ssh/authorizedkeys root@kitploit: python2 evilarc.py -d 5 -p 'home/vsphere-ui/.ssh' -o unix -f evil.tar...

Bagagwa-Exploit-PS5

Bagagwa exploit, PS5 12.40 -- work in progress Thanks to Clau...

cve-2026-45033-class

Claude Code — git 裸仓库 / core.fsmonitor 守卫绕过（PoC） 针对 “恶意裸 git 仓库 →core.fsmonitor → 代码执行” 漏洞类（参见 GitHub Copilot CLI 中的 CVE-2026-45033）的概念验证，已在 Claude Code 上复现，并绕过了 Claude Code 额外添加的 bash 权限守卫（Copilot 没有该守卫）。 结果：当 agent 在文件被放置在守卫之后的仓库中运行 git 命令时，可在 Claude Code 的沙箱内执行代码 。Payload 为惰性（将时间戳写入...

DEBIAN-CVE-2026-91749

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-91745

Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91747

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91749

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...