ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM लीक एक क्लिक से ब्राउज़रों से NTLM हैश लीक करने की अनुमति देने वाली नई भेद्यता द्वारा Ruben Enkaoua विवरण Microsoft ms-photos URI स्कीम fileName को पैरामीटर के रूप में लेती है, जिसे UNC पथ के साथ सबमिट किया जा सकता है, जिससे खोलने पर NTLMv2-SSP हैश लीक हो जाते हैं। एक...

rugmuncher-backend

RMI Backend Repo: git.rugmunch.io/RugMunchMedia/rmi-backend Deploy: /root/backend/ su Talos Container: rmi-backend Health: http://127.0.0.1:8000/health attualmente non sano — l'host Redis non risolve Cos'è Backend FastAPI per la piattaforma RMI. Fornisce scansioni del rischio dei token, analisi...

CVE-2018-9995-DVR-Credentials-Extractor

Tool mostra le credenziali DVR root@kitploit: Strumento originale: https://github.com/ezelf/CVE-2018-9995dvrcredentials Titolo dell'exploit: "Ottiene le credenziali DVR" CVE: CVE-2018-9995 Punteggio base CVSS v3: 7.3 / 10 Stringa del vettore CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Data...

hermetic

Der agentenisolierte Credential-Broker. Ihr KI-Agent führt den authentifizierten Aufruf durch. Er sieht nie den Schlüssel. -brightgreen?style=flat-square Webseite · Installation · Schnellstart · Funktionsweise · Sicherheitsmodell · Schwachstelle melden !IMPORTANT Ihr KI-Agent arbeitet auf der ★★★...

agent-sweep

AgentSweep Finde und schwärze Geheimnisse im lokalen Verlauf deines KI-Code-Agenten. Vollständig offline. Prävention: Füge keine API-Schlüssel in cloudgestützte KI-Agenten ein – der Schlüssel durchläuft die Server des Anbieters, bevor er deine Festplatte erreicht. Wenn du es bereits getan hast:...

PT-2026-80914

NetworkManager did not apply the private user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

PT-2026-80906

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

Malicious code in hydration-dim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3659ec02e8317602c089b822a4a0533bee515d9666d07fdaf3cdf8b315a46147 On import, dist/index.mjs verifies a SHA-256 digest of a bundled Linux x8664 ELF at dist/internal/calc.dat, chmods it to 0755, and spawns it detached...

secret-regex-list

Geheime Regex-Liste Liste von Regex zum Extrahieren geheimer API-Schlüssel und interessanter Informationen. Du kannst dies direkt kopieren und in deinen Python-Code einfügen; einige Regexe benötigen möglicherweise drei Anführungszeichen, sonst bricht der Code. root@kitploit: "Cloudinary" :...

jit

jitpass - password just-in-time Credenziali just-in-time per la tua macchina di sviluppo. Documentazione · Avvio rapido · Strumenti supportati · Riferimento comandi · Sicurezza Stato: solo macOS Apple Silicon, e ancora in fase di sviluppo. Cos'è jit in 30 secondi I tuoi segreti vivono in chiaro s...

CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380

Netty (io.netty:netty-codec-socks) versions 4.1.x through 4.1.136.Final and 4.2.0.Final through 4.2.16.Final contain null byte and CRLF injection vulnerabilities in the Socks4ClientEncoder and Socks5ClientEncoder . The encoders fail to validate domain address and authentication (username/password...

EUVD-2026-64272

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-19093 Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

KeeFarceReborn

KeeFarce Reborn Una DLL autonoma che esporta i database in chiaro una volta iniettata nel processo di KeePass. Fortemente ispirata ai grandi progetti KeeFarce, KeeThief e KeePassHax. Perché un altro strumento di estrazione KeePass? Qualche anno fa, @denandz ha rilasciato KeeFarce, il primo...

Linux Distros Unpatched Vulnerability : CVE-2026-62380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection...

CVE-2026-53572

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-62960

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...