tmpmail

A temporary email right from your terminal written in POSIX sh tmpmail is a command line utility written in POSIX sh that allows you to create a temporary email address and receive emails to the temporary email address. It uses 1secmail's API to receive emails. By default w3m is used to render th...

CVE-2025-51867

CVE-2025-51867 漏洞描述 Deepfiction AI 是一家致力于通过个性化故事叙述进行革命的人工智能娱乐公司。Deepfiction AI 提供一个网页应用，用户可以通过与 LLM 聊天来创作故事，该应用的聊天组件存在不安全的直接对象引用（IDOR）漏洞。攻击者可以利用此 IDOR，消耗其他用户的积分与 LLM 进行聊天。 攻击向量 API 端点 https://www.deepfiction.ai/api/story/create-story-part 用于启动或继续对话。测试表明，该 API 仅依赖请求体中的 treatmentid 和 userid 字段进行访问控...

New API < v0.12.10 - Stripe Webhook Bypass

New API v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication. id: CVE-2026-41432 info: name: New API v0.12.10 - Stripe Webhook Bypass author: str4k3r...

Adamantium-Thief

🔓 Adamantium-Thief Get chromium based browsers: passwords, credit cards, history, cookies, bookmarks, autofill. Chrome 80 is supported! Need firefox passwords decryptor? 🌿 Examples: 🔑 Get passwords from browsers: root@kitploit: Stealer.exe PASSWORDS 💳 Get credit cards from browsers: root@kitploit...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

fprobe

FProbe FProbe - Fast HTTP Probe Installation root@kitploit: GO111MODULE=on go get -u github.com/theblackturtle/fprobe Features Take a list of domains/subdomains and probe for working http/https server. Optimize RAM and CPU in runtime. Support special ports for each domain Verbose in JSON format...

CVE-2026-71537

Paymenter , an open-source webshop solution for hosting services, is affected by a credit-refund double-spend race condition in the service downgrade flow. In app/Livewire/Services/Upgrade.php::doUpgrade(), the method checks Service::upgradable and later executes $credit-&gt;increment('amount', a...

CVE-2026-71537 Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade relies on Service::upgradable to check for a pending service upgrade and later executes $credit-increment'amount', abs$price without DB::transactio...

CVE-2026-71537 Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade relies on Service::upgradable to check for a pending service upgrade and later executes $credit-increment'amount', abs$price without DB::transactio...

CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

memscan

memscan Busca cadenas, expresiones regulares, números de tarjeta de crédito y pistas de tarjetas de banda magnética en el espacio de memoria de un proceso Escáner de memoria/procesos Escrito por Matt Lewis, NCC Group 2014 Actualizado por Tom Watson, NCC Group 2015 Gracias a Jesse Bullock por much...

CVE-2026-22012-Diameter-Protocol-Credit-Control-Bypass-in-5G

CVE-2026-22012 – Bypass de Control de Crédito del Protocolo Diameter en 5G Código del programa simulador Diameter en Python root@kitploit: diametercreditcontrolsim.py - Simulated OCS with missing final-unit indication class OCS: def processCCRself, request: Vulnerability: always returns SUCCESS...

DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis

1. Robo de Tarjetas de Crédito – Extracción de Datos de Tarjetas El análisis de memoria con Process Hacker revela que DarkTortilla RAT se dirige a la información de tarjetas de crédito, incluidos números de tarjeta, fechas de vencimiento y tipos de tarjeta. Cadenas Clave Observadas:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: schfq: Fix for integer overflow of “credit”. If schfq is configured with “initial quantum” values greater than INTMAX, the first assignment of “credit” will cause signed integer overflow, resulting in a very negative...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transport derives its TX credit directly from peerbufalloc, which is set based on the remote endpoint’s SOVMSOCKETSBUFFERSIZE value. On the host side, this means that th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: octeontx2-af: Workarounds for stalls caused by disabling sticky operations. It is known that the sticky mode of the NIX SQ manager can cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE ma...

CVE-2026-89251 AVideo Missing Authorization via AD_Server log.php Wallet Credit

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

EUVD-2026-76063

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

CVE-2026-89251

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in plugin/AD_Server/log.php. The plugin fails to validate ad impressions, allowing any logged-in user to submit arbitrary label values that trigger unverified YPTWallet credits to campaign video...