Faker: helpers.fake exploitable into arbritary code execution

Summary faker.helpers.fake can be tricked into arbritary code execution. Details fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after on...

CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-77009

CVE-2026-77009 affects the WatchMan-Site7 WordPress plugin through version 4.2.0 . The plugin fails to restrict access to its debugging console , which executes user-supplied PHP code . Any authenticated user with a low privilege level (e.g., a subscriber ) can leverage this to achieve remote cod...

EUVD-2026-70039

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

EUVD-2026-70033

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821

Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs

A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. This vulnerability occurs when skbgroreceive attempts to merge zerocopy socket buffers skbs without properly managing page reference counts, specifically when the SKBFLMANAGEDFRAGREFS flag is set. An attacker...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting root@kitploit: python3 poc.py Example With debug set to False default root@kitploit: python3 poc.py...

CVE-2026-20841

此 PoC 触发方式的准确性尚未验证，仅供参考/信息用途。 CVE-2026-20841 - Windows notepad.exe 远程代码执行（RCE） 利用条件： 测试环境：记事本版本 11.2510.14.0 步骤 1：保存文件 步骤 2：打开文件 注意：点击时会提示打开程序（或继续）...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication. The command executes as the user, outside the...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation

= doi.org/10.5281/zenodo.18413764 = orcid.org/0009-0007-7728-256X root@kitploit: README.md CVE-2026-0628：Chromium WebView 权限提升（源欺骗）——技术研究与概念验证 作者： Sastra Adi Wiguna（Purple Elite Teaming） 研究日期： 2026年1月 CVE ID： CVE-2026-0628 CVSS v3.1： 8.8（高危） 受影响版本： Chromium 标签注入精心构造的 HTML/JS 载荷。 3. WebView 策略验证绕过...

CVE-2026-39987-Lab

CVE-2026-39987 — marimo 预认证终端 WebSocket RCE 实验环境 仅限本地的 Docker 实验环境，用于复现和理解 marimo 中的 CVE-2026-39987。 本项目将存在漏洞的 marimo 服务与已修复的 marimo 服务并排对比，然后使用最小危害证明脚本演示两者之间的差异。 执行摘要 CVE-2026-39987 是 marimo （一个响应式 Python 笔记本框架）中的一个严重的预认证远程代码执行漏洞。 漏洞行为存在于终端 WebSocket 端点： root@kitploit: /terminal/ws...

WhatsRCE

WhatsRCE 这是一个用于 CVE-2019-11932（WhatsApp 远程代码执行）的自动化 Payload 生成工具 1. 自动安装 GCC（无危害命令，你可以看到这是开源的） 2. 保存为 .GIF 文件 如何使用？ root@kitploit: sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRCE && bash start.sh 如何获取 Shell？ 1. 你只需将 .GIF 文件以文档形式（而非图片）发送给受害者用户 2. 然后在 WhatsRCE...

CVE-2026-39387

CVE-2026-39387 — BoidCMS 认证文件上传至模板注入 RCE 描述 BoidCMS -l -p 参数 示例 root@kitploit: python3 CVE-2026-39387.py -u http://target.com -l admin -p password123 漏洞利用完成后，将提供一个交互式 shell 提示符（cmd ）用于在远程主机上执行命令。 漏洞利用流程 root@kitploit: 1. 登录 → POST /admin （带 CSRF token） 2. 上传 shell → POST /admin?page=media （包含 PHP...