EUVD-2026-107388

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp...

CVE-2026-76466 Cisco Expressway Series Remote Code Execution Vulnerability

A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies...

CVE-2026-76466

A vulnerability in the database service feature of Cisco Expressway Series (Expressway-C and Expressway-E devices) allows an unauthenticated, remote attacker to execute arbitrary operating system commands as root . The root cause involves the use of persistent cookies and insufficient validation ...

PHP2Shell: Why websites are going offline for emergency security updates

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: body="/@vite/client" Hunter search syntax: web.body="/@vite/client" Exp script usage -u to check -p...

PwnLnX

PwnLnX An advanced multi-threaded , multi-client python reverse shell for hacking linux systems. There's still more work to do so feel free to help out with the development. Disclaimer : This reverse shell should only be used in the lawful, remote administration of authorized systems. Accessing a...

self-service-password

LDAP Tool Box Self Service Password Presentation Self Service Password is a PHP application that allows users to change their password in an LDAP directory. The application can be used on standard LDAPv3 directories OpenLDAP, OpenDS, ApacheDS, Sun Oracle DSEE, Novell, etc. and also on Active...

Stitch

DISCLAIMER Stitch is for education/research purposes only. The author takes NO responsibility and/or liability for how you choose to use any of the tools/source code/any files provided. The author and anyone affiliated with will not be liable for any losses and/or damages in connection with use o...

CVE-2026-91381

A flaw was found in OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification or deletion by submitting untrusted input to APIs in the 2D graphics component. Exploitation can occur through network services that pass data to these APIs or in clie...

CVE-2026-91335

A flaw was found in OpenJDK's Abstract Window Toolkit AWT. A remote attacker with low privileges could exploit this vulnerability by convincing a user to run untrusted code within a sandboxed environment. Successful exploitation allows unauthorized read access to a subset of accessible data,...

raspi-corelight

Corelight@Home raspi-corelight v3.2 Configure the Pi to Run Corelight Software Sensor The Corelight Software Sensor is a 64-bit application, so we have created a configuration tool raspi-corelight to perform initial configuration of the sensor and Raspberry Pi OS. To install and run this tool,...

Gallery-Plugin-SQL-Injection

Exploit Title: Wordpress Video Gallery - YouTube Gallery and Vimeo Gallery Plugin SQL Injection Date: 2024-07-05 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://total-soft.com/wp-video-gallery/ Version 2.3.6 1. Access the Admin Panel: Navigate to the admin panel of your...

CVE-2021-3007-docker-poc

CVE-2021-3007 — Laminas/Zend HTTP Deserialization RCE This repository contains a fully reproducible Proof-of-Concept and Nuclei exploit template for CVE-2021-3007, a critical PHP deserialization vulnerability in Zend\Http\Response\Stream laminas-http Nuclei exploit template ├── docker-compose.yml...

CVE-2026-91400

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

CVE-2026-91333

A flaw was found in the Security component of Oracle Java SE. An unauthenticated remote attacker with network access could exploit this flaw by supplying crafted input to exposed application programming interfaces APIs or by executing untrusted code within sandboxed environments. A successful...

mad-metasploit

Metasploit custom modules, plugins, resource script and.. awesome metasploit collection https://www.hahwul.com/p/mad-metasploit.html Awesome open awesome.md Add mad-metasploit to metasploit framework 1. config your metasploit-framework directory $ vim config/config.rb $metasploitpath =...

pySigma

pySigma pySigma is a python library that parses and converts Sigma rules into queries. It is a replacement for the legacy Sigma toolchain sigmac with a much cleaner design and is almost fully tested. Backends for support of conversion into query languages and processing pipelines for transforming...

sj

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...

Cheatsheet-God

UPDATE: Added my huge link of bookmarks / references ❤️ Do you have a million bookmarks saved? Do all of those bookmarks contain unique information? Github repos starred for later? Well this is a compilation of all of these resources into a single repo known as Cheatsheet-God. No more need for...