PT-2026-90799

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...

CVE-2026-90581: Improper Control of Generation of Code

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-90488 Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

CVE-2026-90488

Xuxueli xxl-job (up to 3.4.2 ) is vulnerable to code injection via the GroovyClassLoader.parseClass function in GlueFactory.java (xxl-job-core). The vulnerability allows remote exploitation with low complexity and low privileges required, resulting in a CVSS 3.1 score of 6.3 (MEDIUM) . A proof-of...

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation in the wild. Details of the...

redamon v6.14.1

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...

enterprise-network-pentest-project

Enterprise Network Penetration Testing Lab A self-built, isol...

PT-2026-90726

Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions prior to 3.4.3 Description Improper privilege management exists in the JobGroupController.java file. This issue allows a remote attacker to manipulate functionality within the...

PT-2026-90727

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

nns-ctf-php-is-my-passion

Competition Introduction NNS CTF is a jeopardy styled CTF comp...

Override

Override A low-level security project focused on binary explo...

SnowCrash

Snow Crash A Linux security project focused on privilege esca...

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence AI company has branded Generative...

PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws

PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation. The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and...

Parrot-Security-Penetration-Testing-Lab

🔴 Parrot Security Penetration Testing Lab Overview This p...

ROS-20260911-73-0204

The vulnerability of the Actor component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

ROS-20260911-73-0199

The vulnerability of Google Chrome and Microsoft Edge browser services is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions remotely...

ROS-20260911-73-0087

The vulnerability of the Password component in browsers Google Chrome and Microsoft Edge is related to deficiencies in the data source verification mechanism. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

ROS-20260911-73-0031

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...