Gogs <= 0.13.3 - Remote Code Execution

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a...

CVE-2025-14847

📝 MongoDB Scanner – Run Notes Script Name mongoexposurescanner.py 1. Prerequisites Python 3.9+ Network access to target hosts Approved scope for scanning Verify Python: python3 --version 2. Files Used File| Purpose ---|--- mongoscanner.py| Scanner script targets.txt| Target hosts and ports...

melee

MELEE: Una herramienta para detectar infecciones de ransomware en instancias MySQL Los atacantes están abusando de las instancias MySQL para llevar a cabo operaciones nefastas en Internet. Los ciberdelincuentes están apuntando a instancias MySQL expuestas y desencadenando infecciones a gran escal...

strafer

Strafer Las infecciones en Elasticsearch están aumentando exponencialmente. Los adversarios están explotando interfaces de Elasticsearch abiertas y expuestas para desencadenar infecciones en implementaciones en la nube y fuera de ella. Durante esta charla, lanzaremos una herramienta llamada...

ollama-silent-patches

OLLAMA SILENT PATCH DISCLOSURE — PUBLIC RELEASE v2 Responsi...

Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

Threat actors are exploiting a maximum-severity security flaw in Flowise , an open-source artificial intelligence AI platform, according to new findings from VulnCheck. The vulnerability in question is CVE-2025-59528 CVSS score: 10.0, a code injection vulnerability that could result in remote cod...

Exploit for Improper Input Validation in N8N

CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain Unauthenti...

PT-2025-43268

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.4.7 Description A critical issue exists in NeuVector where the enforcer component improperly handles environment variables CLUSTER RPC PORT and CLUSTER LAN PORT. These variables are used to construct shell command...

PT-2024-7225

Name of the Vulnerable Software and Affected Versions pfsense version 2.5.2 Description A cross-site scripting XSS vulnerability in pfsense allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at "interfaces groups edit.php". This iss...

PT-2024-4657

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.1.34 Description Ollama has a flaw due to insufficient input validation, leading to a path traversal issue. This allows an attacker to overwrite arbitrary files on the server, potentially leading to remote code...

Update now! MOVEit Transfer vulnerability actively exploited

On May 31, 2023, Progress Software released a security bulletin about a critical vulnerability in MOVEit Transfer. The security bulletin states: "a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an un-authenticated attacker to gain unauthorized...

CISA Issues Warning on Active Exploitation of ZK Java Web Framework Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a high-severity flaw affecting the ZK Framework to its Known Exploited Vulnerabilities KEV catalog based on evidence of active exploitation. Tracked as CVE-2022-36537 CVSS score: 7.5, the issue impacts ZK Framework versions...