CVE-2026-90533 Flowise before 3.1.4 Broken Access Control via organizationuser

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499-root-KernelSU A local privilege escalation ada...

libsignal v0.102.2

Overview libsignal contains platform-agnostic APIs used by the official Signal clients and servers, exposed as a Java, Swift, or TypeScript library. The underlying implementations are written in Rust: libsignal-protocol: Implements the Signal protocol, including the Double Ratchet algorithm. A...

CVE-2025-60854

CVE-2025-60854 D-link AX1500 Vulnerability I recently conducted a vulnerability analysis on a D-Link router and would like to document my findings. Target model: D-Link AX1500 Version : 1.20.01 and below The CVE number for this issue is currently published. The vulnerable function is as follows:...

cve-2026-71362-magento-lab

CVE-2026-71362 — Magento / Adobe Commerce customer-session identity-switch lab A self-contained, one-command Docker lab that reproduces CVE-2026-71362 end to end and lets you verify Adobe's fix, so defenders, researchers and students can study a real account-takeover primitive on a disposable...

Exploit for CVE-2026-78006

CVE-2026-78006-POC POC for CVE-2026-78006 The Events Calendar...

Trinity-Audio-CVE-Report

Trinity-Audio-CVE-Report Disclosure for CVE-2025-9196 CVE-2025-9196 - Vulnerability in Trinity Audio This repository discloses a vulnerability discovered in Trinity Audio = 5.20.1,WordPress plugin developed by sergiotrinity. 🛠 Affected Version Product : Trinity Audio Version : v5.20.1 URL :...

CVE-2020-7693

CVE-2020-7693 Poc Note: I Confirm Payload for CVE-2020-7693 can running in Bug Bounty Program Description: Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20. Single Request Crashes Serve...

COPG v6.9.8

🎮 COPG The most advanced device & CPU spoofer for Android — bypass restrictions and unlock premium graphics, higher FPS and exclusive features on most games and apps. ✨ Why COPG? COPG is a Zygisk module that makes most games and apps believe they are running on a different, fully‑featured flagshi...

Exploit for Static Code Injection in N-Able N-Central

CVE-2026-86218 — N-able N-central Pre-Authentication RCE | IOC...

CVE-2025-55182-Test-Server

CVE-2025-55182-Test-Server Play with react2shell in a safe environment! Quick Start Clone the repo root@kitploit: git clone https://github.com/CharlesTheGreat77/CVE-2025-55182-Test-Server cd CVE-2025-55182-Test-Server Run the docker file root@kitploit: docker compose up --build -d PoC...

Exploit for CVE-2026-85706

CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection...

vmlinux-to-elf

vmlinux-to-elf 이 도구는 vmlinux/vmlinuz/bzImage/zImage 커널 이미지원시 바이너리 블롭 또는 이미 존재하지만 심볼이 제거된 .ELF 파일에서 함수 및 변수 심볼을 복구하여 완전히 분석 가능한 .ELF 파일을 얻을 수 있게 해 줍니다. 이를 위해 이 도구는 커널에서 커널 심볼 테이블kallsyms을 스캔합니다. kallsyms는 거의 모든 커널에 대부분 변경되지 않은 채로 존재하는 압축된 심볼 테이블입니다. 해당 심볼 테이블은 원래 압축되어 있기 때문에 원본 바이너리에는 보이지 않는 문자열도...

CVE-2026-27344

Broken Access Control in Inseri Core WordPress Plugin Plugin: Inseri Core Affected Component: /includes/restapi.php Vulnerability Type: Broken Access Control Missing Authorization Status: Reported in August 2026– Closed as Duplicate. Summary Whilst testing this summer I came across a Broken Acces...

CVE-2019-2618

PoC root@kitploit: POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux i686; rv:20.0 Gecko/20100101 Firefox/20.0 Accept: text/html, image/gif, image/jpeg, /; q=.2 Connection: keep-alive username: weblogic password: weblogic...

CVE-2025-29927

CVE-2025-29927 – Next.js 中间件授权绕过 该仓库包含针对 CVE-2025-29927 的功能性利用代码，这是一个 Next.js 中的严重授权绕过漏洞。该缺陷允许攻击者绕过基于中间件的身份验证和授权检查，从而获得对受保护路由的未授权访问。​ 描述 CVE-2025-29927 是 Next.js 中间件中的一个严重漏洞，攻击者可以通过发送包含内部头部 x-middleware-subrequest 的特制 HTTP...

filekey

🔐 FileKey FileKey is an offline web app that lets you quickly encrypt and share files using passkeys. No accounts, no tracking, no cloud. 🛡️ FileKey is free, open source, and privacy-first. Live at filekey.app. 🚀 Features ✅ Free & Open Source – Licensed under GPLv3. ✅ Accountless – No logins, no...

woody-woodpacker

Woody-Woodpacker A 42 school project that implements a binary packer for 64-bit ELF executables. The packer encrypts the executable's code sections and injects a decryption routine that executes at runtime. 🎯 About Woody-Woodpacker is a program that takes a 64-bit ELF binary as input and creates ...

kubernetes-client__java_CVE-2020-8570_client-java-parent-9_0_2_fixed

Kubernetes Java Client Java client for the kubernetes API. Client versioning The Java client uses Semantic Versioning. We increment the major version number whenever we regenerate the client for a new Kubernetes release version see table below. Whenever we do this there are new APIs added and...

iqoo-temp-root

vivo/iQOO Temporary Root Toolkit No bootloader unlocking, no flashing needed, temporary root lost on reboot. Core principle: CVE-2026-43499 futex PI UAF kernel exploit + temporary KernelSU loading. Supported devices App version Device| Codename| Payload ---|---|--- iQOO Z10 Turbo| z10t / iqooz10t...