CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-21074

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

CVE-2026-21074

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

EUVD-2026-55099

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

CVE-2026-21074

Affected software: Samsung Bixby prior to 4.0.86.0. The issue stems from incorrect default permissions, enabling local attackers to execute arbitrary commands with Bixby privilege. Impact is local privilege escalation; attack requires local access with low privileges and no user interaction. The ...

Monit - Default Credentials Detection

Tries admin:monit against Monit Basic auth WWW-Authenticate realm=monit and looks for Monit: in a 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Monit default credentials admin:monit.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DSR - Default Credentials Detection

Tries admin:admin against /scgi-bin/platform.cgi on D-Link DSR devices and looks for authenticated UI markers or already-logged-in session prompts. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSR devices default credentials admin:admin.""" from urllib.parse import quote from kittysploit...

Edimax Router - Default Credentials (admin/1234)

Detects Edimax and similar routers advertising Basic realm "Default: admin/1234" and accepts login with those credentials CVE-2004-1791. !/usr/bin/env python3 -- coding: utf-8 -- """Edimax router HTTP Basic default credentials admin:1234 CVE-2004-1791.""" import base64 from kittysploit import fro...

MantisBT - Default Credentials Detection

Tries the known MantisBT default credentials administrator:root against /login.php and looks for MANTISSTRINGCOOKIE / logincookietest redirect. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT default credentials administrator/root.""" from kittysploit import from lib.protocols.http.httpclie...

FXC Router - Default Credentials (admin/admin)

Detects FXC and related router web UIs accepting default credentials admin:admin via /cgi-bin/login.apply or /cgi/login.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """FXC router HTTP default credentials admin:admin.""" import time from datetime import datetime, timezone from kittysploit import...

Jenkins - Default Credentials Detection

Tries known Jenkins default credentials admin:password, admin:admin, admin:jenkins, jenkins:jenkins against jspringsecuritycheck / jacegisecuritycheck and verifies Dashboard access. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins default credentials detection admin/password, admin/admin,...

Apache Guacamole - Default Credentials Detection

Tries guacadmin:guacadmin against /api/tokens and looks for authToken in a JSON 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Guacamole default credentials guacadmin/guacadmin.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CVE-2026-19358 3CORESec Trapdoor DefaultFunction access control

A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure...

EUVD-2026-54929

A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure...

CVE-2026-19358

A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure...

CVE-2026-19358

The CVE-2026-19358 entry concerns a weakness in 3CORESec Trapdoor, affecting the DefaultFunction up to version 1.2.2. The manipulation leads to improper access controls, with the attack described as remotely initiable over the network. Connected documents corroborate the affected component and th...

SUSE CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-48120

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...

CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...