PT-2026-106234

Name of the Vulnerable Software and Affected Versions Langflow versions 1.6.8 through 1.9.0 Description Langflow fails to properly authorize the resource URI provided to the resources/read endpoint. The read resource function forwards the attacker-controlled URI to handle read resource, which...

Cisco ASA Insufficient Session Expiration (CVE-2021-1501)

A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in a denial of service DoS condition.The...

Fedora 45 : curl (2026-663a2d0ba4)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-663a2d0ba4 advisory. - fix HTTP/2 server push UAF CVE-2026-18924 - fix Negotiate ambient user conn reuse CVE-2026-19931 - remove test1701 - HTTP/2 Upgrade in a HTTP/1.1...

xzwhy

xzwhy / / / / \ / /\ This project is a Kubernetes-friendly Proof of Concept POC for CVE-2024-3094 affecting XZ Utils. See this article for an excellent walkthrough of the exploit's provenance and mechanics. WARNING ⚠⚠⚠ Running any of the commands below may result in the deployment of a vulnerable...

CVE-2026-8932-PoC

CVE-2026-8932 PoC Proof-of-concept reproduction of CVE-2026-8932 , an incomplete mTLS configuration matching issue in libcurl connection reuse. Overview CVE-2026-8932 affects libcurl's connection reuse logic when mutual TLS mTLS configuration changes between requests. Under vulnerable conditions,...

CVE-2025-67733

RESP Protocol Injection PoC Proof-of-concept demonstrating RESP Protocol Injection vulnerability via Lua script error messages in Valkey/Redis. Files backend.py Flask backend simulating a web application with shared Valkey connection connection pooling. Endpoints: Method| Endpoint| Description...

CVE-2026-11115-Database-Connection-String-Injection-via-Env-Variable

CVE-2026-11115 – Database Connection String Injection via Env Variable Program Code Python dbconnector.py - Constructs DB connection string from environment import os, psycopg2 def connect: Reads DBURL; attacker can override via environment injection if they control an env var dburl =...

CVE-2025-15474

BLE Smart Lock Denial-of-Service DoS Vulnerability An unauthenticated Bluetooth Low Energy BLE connection flood can reliably prevent legitimate users from unlocking the device by interrupting keypad input and forcing repeated lockout states. 📌 Summary This repository documents a Denial-of-Service...

BlueBorn

BlueBorn CVE-2017-0785 Archlinux installation paru -S python-pybluez-git bluez-utils-compat pyhton3 python3-pip sudo pip install pwn TUTORIALS Discovery hcitool scan Scanning ... XX:XX:XX:XX:XX:XX Device 1 XX:XX:XX:XX:XX:XX Device 2 Use the exploit python CVE-2017-0785.py TARGET=XX:XX:XX:XX:XX V...

CVE-2024-43451-POC

Descripción Nombre : CVE-2024-43451 Puntuación CVSSv3 : 6.5 Versiones afectadas : Todas las versiones de Microsoft Windows anteriores al parche de noviembre de 2024 CVE-2024-43451 es una vulnerabilidad de día cero en Microsoft Windows que permite a los atacantes capturar hashes de contraseñas...

CVE-2026-33829-Writeup

CVE-2026-33829-Writeup Vulnerability Case Study: CVE-2026-33829 Windows Snipping Tool NTLM Coercion Executive Summary This write-up details the technical replication of CVE-2026-33829 , an information disclosure vulnerability within the modern Windows Snipping Tool application framework. By abusi...

CVE-2025-27558_Patching

CVE-2025-27558Patching Parche de la vulnerabilidad CVE-2025-27558 que había afectado a mi imagen de Linux. Incidente de Atlas: Conexión saliente inesperada 197.155.77.1 Esta carpeta documenta una anomalía de red real detectada en la máquina Atlas , un sistema Ubuntu monitoreado por Wazuh. Durante...

SVPT_CW_2

CVE-2024-21413 https://github.com/KartheekKandalam99/SVPTCW2 CVE-2024-21413 Setup for CW TRYHACKME provided room for working on this vulnerability. Below is the link to access the room https://tryhackme.com/r/room/monikerlink To access room through RDP we have to connect to TryHackMe VPN. Click...

SQLPad-6.10.0-Exploit-CVE-2022-0944

Exploit SQLPad 6.10.0 CVE-2022-0944 Este script en Bash explota una vulnerabilidad RCE en SQLPad 6.10.0, permitiendo a un atacante lograr ejecución remota de código RCE abusando de los campos host y database en la configuración de conexión MySQL de SQLPad. El exploit aprovecha el manejo no...

CVE-2021-3456

CVE-2021-3456 A practical chain that starts with an innocuous PDF file and ends up in a reverse shell on an AWS EC2 instance The Beginning: Crafting a PDF Payload It all begins on the front end of the attack. Using PowerShell’s built‑in WScript object we embed a script inside a PDF that will be...

Reproducing-ConnMan-1.34

Connection Manager Copyright C 2007-2012 Intel Corporation. All rights reserved. Functionality and features The following features are built-in into Connection Manager: - Generic plugin infrastructure - Device and network abstraction with basic storage support - IPv4, IPv4-LL link-local and DHCP...

CVE-2018-19629

CVE-2018-19629 Test Environment Docker test environment for CVE-2018-19629 - Hyland Perceptive Content Server Denial of Service. Vulnerability Details Field| Value ---|--- CVE ID| CVE-2018-19629 Severity| High DoS Affected Versions| Hyland Perceptive Content Server 7.1.5 Patched Version| 7.1.5...

ReverseSock5Proxy

Reverse TCP Sock5 Proxy A tiny Reverse Sock5 Proxy Server The Server GUI Built with ImGui :V U can download a prebuilt from Releases. Build You need gcc version 12+ recommended one for windows Conan Package Manager And run any script from the scripts folder, depend on your needs :V Client/Agent...

EUVD-2026-91795

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...