CVE-2026-35869

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

system_bt_AOSP_10_r33_CVE-2021-0316

Stack Bluetooth Fluoride Build ed esecuzione su AOSP Basta compilare AOSP - Fluoride è presente di default. Build ed esecuzione su Linux Istruzioni per Ubuntu, testate su 14.04 con Clang 3.5.0 e 16.10 con Clang 3.8.0 Scaricare il codice sorgente root@kitploit: mkdir /fluoride cd /fluoride git clo...

Arlo

Arlo Estrai i binari eseguibili dal dump e dagli aggiornamenti Arlo Vedi il blog post su https://www.synacktiv.com/publications/arlo-im-watching-you Parser arlo.py viene utilizzato per analizzare un dump di memoria Flash, scaricare e analizzare gli aggiornamenti o elencare i modelli noti. Richied...

DLHell

DLHell DLHell führt lokales und entferntes Windows-DLL-Proxying über DCOM aus. Install Die folgenden Pakete werden benötigt kann von deiner Distribution abhängen, das folgende Beispiel ist für Debian 12: root@kitploit: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64...

eos

Nemici di Symfony EOS EOS saccheggia informazioni da un target Symfony in modalità debug: Sezione| Descrizione ---|--- General| Ottieni informazioni generali sul target. Phpinfo| Estrai le variabili d'ambiente Symfony dalla phpinfo esposta. Route| Ottieni l'elenco delle route registrate. Log dell...

Security Bulletin: SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-7769)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to SQL injection. Vulnerability Details CVEID:CVE-2026-7769 DESCRIPTION: IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling...

Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-68121 DESCRIPTION: During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses tomcat-embed-core-10.1.57, netty-codec-http2-4.2.15.Final.jar, mlflow-3.11.1-py3-none-any.whl, gitpython-3.1.49-py3-none-any.whl, docling-2.91.0-py3-none-any.whl, transformers-5.6.2-py3-none-any.whl, ip-address-10.2.0.tgz, bcutil-jdk18on-1.84.jar,...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses keras-3.14.1, bcprov-jdk18on-1.84.jar, sentencetransformers-5.2.0-py3-none-any.whl, pillow-12.2.0-cp311-cp311-manylinux227x8664.manylinux228x8664.whl, tomcat-embed-core-10.1.55.jar, langgraphsdk-0.3.13-py3-none-any.whl, and transformers-4.57.5-py3-none-any.whl which...

RAT-via-Telegram

RAT über Telegram Windows-Fernverwaltungstool über Telegram jetzt in Python 3.7! | Ursprünglich erstellt von Ritiek Warum noch eines? Die derzeitigen Remote-Verwaltungstools auf dem Markt haben zwei Hauptprobleme: Mangel an Verschlüsselung. Erfordern Portweiterleitung, um aus Hunderten von...

DoHC2

⚠️ NOTA: questo strumento non è più in manutenzione attiva. DoHC2 DoHC2 consente di utilizzare la libreria ExternalC2 di Ryan Hanson https://github.com/ryhanson/ExternalC2 per il command and control C2 tramite DNS over HTTPS DoH. È stato creato per il popolare software di Adversary Simulation e Re...

blackpill

BlackPill BlackPill è un rootkit Linux furtivo realizzato in Rust. Caratteristiche Il rootkit è composto da più moduli parlando di moduli Rust, non moduli del kernel: evasione della difesa : nascondere file, processi, connessioni di rete, ecc. hooking : intercettare syscall e IDT hypervisor :...

zyxel-wax650s-research-notebook-public

Quaderno di Ricerca su Zyxel WAX650S Quaderno di ricerca pubblico e sicuro per il firmware Zyxel WAX650S V7.10ABRM.4C0. Questo repository è scritto come wiki in formato narrativo per ricercatori e per futuri lavori di follow-up assistiti da LLM. Documenta come è stato allestito il laboratorio,...

MAL-2026-14568 Malicious code in tailwindcss-form-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bf4e5fbd59048a5ab6a5c04ad7c98e7246c9cf57363d95acc84f92d8ca883f4 src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style 0x string-array cipher that...

Malicious code in tailwindcss-form-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bf4e5fbd59048a5ab6a5c04ad7c98e7246c9cf57363d95acc84f92d8ca883f4 src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style 0x string-array cipher that...

CVE-2026-76220

A flaw was found in GitPython. A remote attacker can bypass the checkunsafeoptions guard by combining a single-character keyword argument with splitsinglecharoptions=False. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as clonefrom, leading ...

CVE-2026-76219

A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree, without proper option validation or...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.323 Vulnerability Details CVEID:CVE-2026-48776 DESCRIPTION: LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python...

CVE-2026-81735

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

PYSEC-2026-3776

opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...