CentOS 9 : kernel-5.14.0-745.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-745.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f scsi...

Linux Distros Unpatched Vulnerability : CVE-2026-90578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gflistcount of the file utils/list.c of the component MP4Box. Executing a...

Linux Distros Unpatched Vulnerability : CVE-2026-72709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-89090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to...

Linux Distros Unpatched Vulnerability : CVE-2026-90771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code...

AlmaLinux 10 : ruby4.0 (ALSA-2026:50773)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:50773 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Amazon Linux 2 : gstreamer-plugins-good (ALAS-2026-3913)

The version of gstreamer-plugins-good installed on the remote host is prior to 0.10.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3913 advisory. GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability...

Microsoft Power Automate for Desktop < 2.71.115.26224 Elevation of Privilege (September 2026)

The version of Microsoft Power Automate for desktop installed on the remote Windows host is prior to 2.71.115.26224. It is, therefore, affected by an elevation of privilege vulnerability. Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally. Note...

RHEL 8 : osbuild-composer (RHSA-2026:67148)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67148 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

AlmaLinux 8 : perl-YAML-Syck (ALSA-2026:67269)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:67269 advisory. YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document CVE-2026-13713 Tenable has extracted the preceding description block directly from the AlmaLinu...

Ubuntu 20.04 LTS / 22.04 LTS : FFmpeg vulnerabilities (USN-8750-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8750-1 advisory. Seung Min Shin discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into...

RHEL 8 : perl-YAML-Syck (RHSA-2026:67269)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67269 advisory. This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data...

RHEL 8 : gstreamer1-plugins-bad-free (RHSA-2026:67151)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67151 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a...

RHEL 10 : nginx (RHSA-2026:67314)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67314 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...

RockyLinux 9 : nginx:1.26 (RLSA-2026:67283)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67283 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLinu...

Linux Distros Unpatched Vulnerability : CVE-2026-86320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - flatpak-builder - None Ubuntu Linux - Unknown description CVE-2026-86320 Note that Nessus relies on the presence of the package as reported by th...

poc-CVE-2019-9053

PoC CVE-2019-9053 - CMS Made Simple SQL注入 用于CVE-2019-9053的Python 3教学PoC，这是CMS Made Simple = 2.2.9中的一个基于时间的盲SQL注入漏洞。 此版本已修改为用于CTF/实验室环境。它包含预配置的前缀以减少提取时间，以及葡萄牙语的解释性信息，帮助学生理解该漏洞利用的工作原理。 警告 本项目仅用于教育目的、受控实验室及CTF环境。 未经明确授权，请勿将此代码用于第三方系统。 本仓库的作者不对该材料的任何滥用行为负责。 漏洞 CVE-2019-9053影响CMS Made...

CVE-2026-16723

CVE-2026-16723 捐赠 请通过 PayPal 或扫描下方二维码来支持本项目的维护。 ⚡ 简单用法 请仅在安全且已获授权的环境中使用本项目，例如： 本地虚拟机 Docker 容器 隔离的实验室环境 已获授权的渗透测试环境 示例设置： root@kitploit: git clone https://github.com/HORKimhab/CVE-2026-16723 cd CVE-2026-16723 Download fastjson JAR optional - script will auto-download wget...

CVE-2026-33454

camel-mail Header Injection → RCE 漏洞复现工具（CVE-2026-33454） 本项目演示 Apache Camel 的 camel-mail 组件中一个 Camel 消息头注入 漏洞，跟踪编号为 CVE-2026-33454 。攻击者若能向 Camel 邮件消费者所监听的邮箱投递邮件，即可将 Camel 控制头注入 Exchange，当路由转发到诸如 camel-exec 之类的对头部敏感的生产者时，可实现 远程代码执行 。 公告：https://camel.apache.org/security/CVE-2026-33454.html 漏洞摘要 属性...

claude-awm

claude-awm: can you scrub a SynthID text watermark by editing the text? Yes, but only one family of attack works, and it isn't the one everyone assumes. Unicode variation selectors category Mn, U+FE00 to U+FE0F and U+E0100 to U+E01EF drive the detector below threshold and stay there. Every other...