CVE-2026-90898

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90708

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-90707

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amfnnrftryoldamfdiscoveryfallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discoveryoption results in use after free. The attack may be...

CVE-2026-90705

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90706

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-87779

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length not 16/24/32 bytes is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15...

CVE-2026-81564

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its...

CVE-2026-81565

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

CVE-2026-14259

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a...

CVE-2026-15814

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a...

CVE-2022-0847-DirtyPipe-Exploit

CVE-2022-0847-DirtyPipe Vulnerability Overview On March 7, foreign security researcher Max Kellermann published a blog disclosing a local privilege escalation vulnerability CVE-2022-0847 in the Linux kernel: https://dirtypipe.cm4all.com/ CVE-2022-0847 is a local privilege escalation vulnerability...

MicroburstSecretsHunter

MicroBurst 机密猎手 一个 PowerShell 扫描器，用于梳理 MicroBurst Get-AzDomainInfo 的输出，查找明文密码、密钥、连接字符串以及其他绝不应以未加密形式存在于 Azure 环境中的机密。 专为 只读审计工作流 而构建：你可以使用 MicroBurst 收集域转储（对于 Get-AzDomainInfo，Reader 权限就足够了），然后将此工具指向输出文件夹。它不会 接触 Azure 本身——它只读取你已经导出的文件。机密值在所有报告中都被脱敏 ，因此输出可以安全地附加到发现项中。 快速开始 root@kitploit: Clone / co...

CVE-2023-27216

CVE-2023-27216 - Router DLink Este documento es mi experiencia personal como novato en la reversión y explotación de firmware. Alcance Para la demostración, analizaremos y reproduciremos CVE-2023-27216. Número CVE: CVE-2023-27216 Descripción de la vulnerabilidad: Un problema encontrado en D-Link...

FortiLPE

説明 Windows上で動作するFortiClient VPNを対象としたCVE-2025-62676 / EUVD-2025-206993のローカル特権昇格PoCエクスプロイトです。任意のXMLファイル書き込みを介して、通常ユーザーコンテキストからSYSTEMコンテキストでペイロードを実行します。このPoCはWindows 11 Pro上のFortiClientバージョン7.4.0でテスト済みです。ベンダーによると、以下のバージョンが脆弱です： 7.4.0～7.4.4 7.2.0～7.2.12 7.0（全バージョン） 本脆弱性はTrend Micro Zero Day...

CVE-2026-90709

Yot CMS versions up to 3.3.1 are affected by a code injection vulnerability in the Admin Console component. The root cause is the use of the eval function in modsys/console/admin.php, where manipulation of the text POST argument allows an attacker to inject and execute arbitrary code. The attack ...

CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

EUVD-2026-77428

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

project-memoria-detector

project-memoria-detector The project-memoria-detector tool aims to determine whether a target network device runs a specific embedded TCP/IP stack. Currently, the tool supports fingerprints for 16 embedded TCP/IP stacks and their variations: uIP, Contiki or Contiki-NG picoTCP or picoTCP-NG Nut/Ne...

htshells

HTSHELLS - 通过 .htaccess 文件实现的自包含 Web Shell 及其他攻击。 攻击的命名方式为 module.attack.htaccess，并按攻击类型分组存放在目录中。选择你需要的攻击，将其复制到一个新文件并命名为 .htaccess，检查文件以确认在上传前是否需要编辑。除非文件另有说明，Web Shell 通过查询参数 c 执行命令。 要准备攻击，运行 ./prepare.sh file 生成待上传的 .htaccess 文件。示例： root@kitploit: $ ./prepare.sh shell/modphp.shell.htaccess ┬...