OESA-2026-3909 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A flaw was found in xdgmime. A heap-base...

OESA-2026-3906 openjdk-1.8.0 security update

The OpenJDK runtime environment 8. Security Fixes: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's pngdoquantize function whe...

OESA-2026-3903 file-roller security update

File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive. Security Fixes: A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive...

OESA-2026-3891 exiv2 security update

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fixes: Exiv2 has an out-of-bounds read...

OESA-2026-3890 exiv2 security update

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fixes: Exiv2 has an out-of-bounds read...

OESA-2026-3889 exiv2 security update

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fixes: Exiv2 has an out-of-bounds read...

OESA-2026-3888 exiv2 security update

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fixes: Exiv2 has an out-of-bounds read...

OESA-2026-3882 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. During storage volume clone or convert operations,...

OESA-2026-3879 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links,...

OESA-2026-3880 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links,...

OESA-2026-3876 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A flaw was found in...

OESA-2026-3874 hdf5 security update

HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF...

OESA-2026-3875 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A flaw was found in...

OESA-2026-3873 hdf5 security update

HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF...

OESA-2026-3872 hdf5 security update

HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF...

CVE-2025-27136

CVE-2025-27136 利用 XML 外部实体 XXE 漏洞。 使用 XML 载荷抓取敏感文件（PoC） test.xml root@kitploit: 使用 curl 将 test.xml 从本地机器上传到存储桶。 root@kitploit: curl -X PUT http://127.0.0.1:PORT/TB1 -H "Content-Type: application/xml" -d @test.xml 触发漏洞并获取文件 root@kitploit: curl http://127.0.0.1:PORT/TB1?location...

PoC-Apache-CVE-2021-41773-Infrastructure-LAB

Apache CVE-2021-41773 — Laboratorio Docker PoC Aviso de Seguridad Este repositorio reproduce una vulnerabilidad divulgada públicamente y parcheada en un entorno controlado de laboratorio Docker con fines educativos y de investigación. El entorno es intencionalmente vulnerable y solo debe...

CVE-2022-1388

CVE-2022-1388 PoC for CVE-2022-1388 affecting F5 BIG-IP. Usage root@kitploit: $ ./poc.sh --help Usage: poc.sh --help --file FILE --scan --exploit --payload PAYLOAD CVE-2022-1388 PoC script. One or multiple IPs can be scanned. Arguments: --help Show this help message and exit. --file FILE File lis...

CVE-2022-30136

CVE-2022-30136 Windows 网络文件系统远程利用（拒绝服务）概念验证 概念验证：https://github.com/fortra/CVE-2022-30136 详细信息：https://www.coresecurity.com/core-l...136-windows-network-file-system-vulnerability 受影响产品：Windows Server 2016、2019...

CACredDecoder

C-Ark 凭证解码器 针对 CVE-2021-31796 的漏洞利用工具 用于解码 C-Ark 凭证文件的工具 作者：Aaron Mizrachi - https://twitter.com/unmanarc/ Enrique Vaamonde - https://twitter.com/ejvm 首次发布：2019年9月2日 公开披露：2021年10月11日 参考资料 https://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effective-Key-Space.html...