CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

vibe-coding-security

Vibe Coding Security Before you tweet your launch, run these 69 checks. They map to the exact patterns behind the Lovable RLS CVE CVE-2025-48757, 170+ apps, 2025, the Moltbook leak 1.5M API tokens, Feb 2026, and the April 2026 Lovable platform breach source code + service keys of other users'...

EUVD-2026-76141

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-89265

MoguBlog through 6.2 contains an authorization bypass in the admin endpoint POST /pictureSort/getPictureSortByUid , which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid ...

CVE-2026-38058

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

EUVD-2026-76131

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-81861

CVE-2026-81861 affects Schneider Electric SCADAPack and stems from CWE-522 (Insufficiently Protected Credentials) in the Secure Lock component. The flaw could expose authentication information and permit unauthorized access to RTU functionality . The CVSS 4.0 base score is 5.9 (MEDIUM) , with a n...

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-38058 ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

CVE-2026-38058

ST Engineering iDirect iQ200 VSAT terminals are affected by an information exposure flaw where an endpoint returns the complete device configuration as JSON, including the SECURITY section containing MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid w...

Azure

Azure Offensive Security Toolkit A collection of Bash and PowerShell scripts for Azure security assessments, covering IAM privilege escalation, container security, Key Vault exposure, Entra ID configuration, and more. Designed to run in Azure Cloud Shell or any authenticated terminal. Scripts IAM...

CVE-2026-89298

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-langgraph

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual environment...

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report This post-incident report examines the 2025 supply chain breach targeting Oracle Cloud’s identity and authentication infrastructure. It details how threat actors exploited an unpatched pre-authentication Remote Code Execution vulnerability...

CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

Magnohost-Vulnerabilities-pentest

MagnoHost-pentest pentest on MagnoHost hosting provider & MeteorCloud infrastructure. Findings: MariaDB exposed on 6 servers CVSS 9.8, OmniDialer default creds full access, Wings CVE-2024-27102 9.9, Grafana exposed, DMARC spoofing. Only curlcffi + Python. Zero automated scanners. target informati...

ROOT-OS-DEBIAN-11-CVE-2025-12781 CVE-2025-12781 in python3.9 - Patched by Root

Root has patched CVE-2025-12781 in the python3.9 package for Root:Debian:11. Multiple fixed versions available...

AntiWeb_testing-Suite

ICS/OT AntiWeb: Testing Suite Introduction A vulnerability has been found in ICS/OT-associated web applications running on Anti-Web servers up to version 3.8.7. The vulnerabilities that have been identified affect several well-known manufacturers in the industrial process automation and...

CVE-2026-89173

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – GraphQL Batching Alias Rate Limit Bypass Program Code Node.js + Python Exploit root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema = require'graphql';...