lettre has TLS hostname verification disabled when using Boring TLS backend

Summary An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN...

CVE-2026-64644

A flaw was found in Next.js, a React framework. When self-hosting Next.js with the default image loader and configured to optimize remotely hosted images, a remote attacker could exploit the Image Optimization API. By providing malicious images, the attacker can cause CPU exhaustion, leading to a...

CVE-2026-65881

The Joomdle Joomla extension (versions

CVE-2026-65881

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

EUVD-2026-49791

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

CVE-2026-65881 Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

CVE-2026-65881 Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

CVE-2026-65881

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

Integrated Management Module - Default Login Detection

Integrated Management Module default login credentials were discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Integrated Management Module default login credentials were discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Wildfly - Default Admin Login Detection

Wildfly default admin login credentials were successful. !/usr/bin/env python3 -- coding: utf-8 -- """Wildfly default admin login credentials were successful.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wildfly -...

SAP NetWeaver Portal - Detect

SAP NetWeaver Portal login has been detected. Note that NetWeaver has multiple default passwords as listed in the references. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Portal login has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

OpenSpeedTest - Detect

Detected the exposed default page of the OpenSpeedTest service. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the exposed default page of the OpenSpeedTest service.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Operations Automation Default Page Detection

Detects Operations Automation Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Operations Automation Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Operations Automation Default Page...

Huawei HG532e Default Credential Detection

Huawei HG532e default admin credentials were discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG532e default admin credentials were discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Huawei...

Huawei HG532e Router Panel - Detect

Huawei HG532e router login panel was detected. After installation, both the default username and default password are user. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG532e router login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Huawei Router - Authentication Bypass Detection

Huawei Routers are vulnerable to authentication bypass because the default password of this router is the last 8 characters of the device's serial number which exist on the back of the device. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Routers are vulnerable to authentication bypass...

Kube API Pods Detection

Scans for kube pods !/usr/bin/env python3 -- coding: utf-8 -- """Scans for kube pods.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kube API Pods Detection', 'description': 'Scans for kube pods', 'author':...

3COM NJ2000 - Default Login Detection

3COM NJ2000 contains a default login vulnerability. Default admin login password of 'password' was found. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """3COM NJ2000...

mantisbt - Anonymous Login Detection

mantisbt Anonymous login were discovered. !/usr/bin/env python3 -- coding: utf-8 -- """mantisbt Anonymous login were discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'mantisbt - Anonymous Login Detection',...

GUDE - Default Login Detection

GUDE 2301 and 2302 default administrator login credentials admin:admin were detected. !/usr/bin/env python3 -- coding: utf-8 -- """GUDE 2301 and 2302 default administrator login credentials admin:admin were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...