clients web-v2026.9.0

Bitwarden Client Applications This repository houses all Bitwarden client applications except the mobile applications iOS | android. Please refer to the Clients section of the Contributing Documentation for build instructions, recommended tooling, code style tips, and lots of other great...

certgraveyard_yara v2026.09.16

CertGraveyard YARA Rules Generator Automated YARA rule generation from the CertGraveyard compromised certificate database. Features 🔄 Daily Updates : Automatically checks CertGraveyard for new compromised certificates 📝 YARA Rule Generation : Creates individual YARA rules for each certificate ✅...

CVE-2025-11988

1 提取公开的 cryptoajax nonce root@kitploit: UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Resumen Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2022-46364 , una vulnerabilidad de Inclusión de Archivos Locales LFI en Apache CXF. La vulnerabilidad surge debido al manejo inadecuado de los elementos XOP XML-binary Optimiz...

CVE-2025-14847-MongoBleed-Exploit

CVE-2025-14847 - MongoBleed 👨‍💻 Autor: Furkan KAYAPINAR @FurkanKAYAPINAR ⚠️ SOLO CON FINES EDUCATIVOS Entorno de laboratorio y script de explotación para la vulnerabilidad crítica de fuga de memoria no autenticada en MongoDB Server. 📋 Tabla de Contenidos Resumen de la Vulnerabilidad Versiones...

keyguard

keyguard 扫描代码库、GCP 项目和 CI 流水线中暴露的 Google API 凭据——在它们被利用之前。 问题： Google 在已有的 API 密钥（Maps、Places 等）上回溯启用 了 Gemini API 访问，这些密钥本来设计为公开并嵌入客户端代码。当团队中有人在同一个 GCP 项目中启用 Gemini 时，那些本已公开的密钥会悄悄变成 Gemini 凭据——导致项目面临未经授权的 AI 使用风险，并可能产生超过 8 万美元的账单事故（背景）。 keyguard 的功能： keyguard scan —— 使用正则表达式 + 熵检测，在源文件和 Git...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 一个基于Python的安全工具，用于检测和利用WordPress WP File Upload插件（版本 = 4.24.11）中的任意文件读取漏洞。...

CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: Marco de Explotación RFCOMM Bluetooth "Heartbleed" CVE-2025-13834 Autor: Sastra Adi Wiguna Purple Elite Teaming Fecha: 20 de enero de 2026 Versión: 1.0 Réplica a nivel de sistema completo Licencia: SOLO USO EN RED TEAM N...

CVE-2026-87796

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87935

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

CVE-2025-26788

CVE-2025-26788 Configuración del entorno Paso 1 - Verificar la ejecución de Docker Desktop docker version Paso 2 - Construir la imagen cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . Paso 3 - Ejecutar el contenedor docker run -d --name skfs --hostname skfs.localdomain...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

CVE-2026-18718

Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...

gstreamer-plugins-base: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow

A flaw was found in GStreamer. This vulnerability, a stack-based buffer overflow, occurs during the parsing of OGG files due to improper validation of user-supplied data length. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file,...

Important: Red Hat Security Advisory: gstreamer1-plugins-base security update

An update for gstreamer1-plugins-base is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

CVE-2026-54088-poc

CVE-2026-54088: Inyección de comandos por sustitución de shell en el hook de autenticación RCE previo a la autenticación English version Resumen Este repositorio es una prueba de concepto PoC para la vulnerabilidad crítica de inyección de comandos del sistema operativo CVE-2026-54088 presente en...

PoC-2023-43208

CVE-2023-43208-EXPLOIT Exploit de Ejecución Remota de Código RCE en Mirth Connect ⚠️ SOLO PARA USO EDUCATIVO Y EN LABORATORIO ⚠️ Un exploit de prueba de concepto para CVE-2023-43208, una vulnerabilidad de ejecución remota de código en Mirth Connect anterior a la versión 4.4.1. 🚨 AVISO LEGAL...

ai-code-review

🔍 codereview AI 驱动的终端代码审查。 一条命令。即时反馈。在代码进入生产环境前捕获安全漏洞、错误和不良模式。 安装 · 快速开始 · 使用 · 提供商 · 贡献 它能做什么 codereview 将你的代码发送给 LLM，并在终端中直接返回结构化的、颜色编码的审查报告——包含严重性评级、行号引用和具体的修复建议。 无需浏览器。无需 PR。无需等待队友。只需： root@kitploit: codereview app.py 捕获真实的安全漏洞——评分 2/10 审查自身源代码——评分 9/10 为什么用 独立开发者 —— 无需等待他人，即可获得第二双眼睛 预提交检查 ——...

bramble v1.29.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

CVE-2025-55182_Vulnerable-Application

ES Module Lexer A JS module syntax lexer used in es-module-shims. Outputs the list of exports and locations of import specifiers, including dynamic import and import meta handling. Supports new syntax features including import attributes and source phase imports. A very small single JS file 4KiB...