New Instagram and Facebook rules set a default two-hour limit for teens

Meta decided that discretion was the better part of valor on Wednesday, agreeing to settle a landmark child safety case for up to $17 billion. The agreement would introduce a default two-hour daily limit for teens on Instagram and Facebook, overnight restrictions, and a range of other protections...

CVE-2026-41940

CVE-2026-41940 Auto Exploit Panoramica CVE-2026-41940 è un proof-of-concept PoC che mira a cPanel/WHM. Questo exploit dimostra un bypass di autenticazione non autenticato utilizzando l'iniezione CRLF per divulgare i token di sicurezza e ottenere accesso a livello root all'interfaccia WHM,...

GhostShell

GhostShell CVE-2026-31431 — Escalatazione dei Privilegi Locali tramite Corruzione della Page Cache del Kernel Linux GhostShell è uno strumento di escalation dei privilegi locali che sfrutta una vulnerabilità nell'implementazione AEAD authencesn del kernel Linux per ottenere una shell di root da u...

droidground v1.0.14

DroidGround Website | Demo In traditional CTF challenges , it's common to hide flags in files on a system, requiring attackers to exploit vulnerabilities to retrieve them. However, in the Android world, this approach doesn't work well. APK files are easily downloadable and reversible, so placing ...

LSN-0121-1: Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipcmsgsendrequest ipcmsgsendrequest waits for a generic netlink reply using an ipcmsgtableentry on the stack. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix...

LSN-0121-1 Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipcmsgsendrequest ipcmsgsendrequest waits for a generic netlink reply using an ipcmsgtableentry on the stack. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix...

JavaScript obfuscation: From party trick to phishing kit

We open a JavaScript artifact hoping for code, and instead get string arrays, strangely named functions, encoded URLs, runtime decoders, and eval statements. That is the point where "reading the script" stops being enough. Obfuscated JavaScript is still code, but it is code with the useful contex...

FortiSandbox-RCE-Exploit-CVE-2026-39808

FortiSandbox RCE-Scanner — CVE-2026-39808 Nicht authentifizierte OS-Befehlsinjektion als root in Fortinet FortiSandbox Schwachstelle • Installation • Verwendung • Funktionsweise • Pipeline • Shodan-Dorks • Haftungsausschluss Schwachstelle CVE-2026-39808 ist eine kritische, nicht authentifizierte...

CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 Descrizione Esiste una vulnerabilità di cross-site scripting XSS riflesso in /dashboard/settings.php nel Bank Management System in Web 1.0. La vulnerabilità si verifica a causa di una sanitizzazione impropria dell'input fornito dall'utente nel parametro GET msg. Un...

sandbox-runtime v0.0.74

Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...

CVE-2025-4476-Exploit

CVE-2025-4476-Exploit Ein kleiner Python-Testclient zum Senden von HTTP-GET-Anfragen mit einem überdimensionierten Authorization: Basic-Header. Dieses Tool ist für Labortests und Forschung zu Header-Parsing-Problemen gedacht z. B. Null-Dereference-/Absturzfehler wie CVE-2025-4476 in libsoup. Es...

CVE-2026-39324

CVE-2026-39324 Exploit PoC Rack::Session::Cookie-Entschlüsselungsfehler führt dazu, dass unverschlüsselte Cookies akzeptiert werden | ---|--- Advisory| GHSA-33qg-7wpp-89cq Paket| rack-session RubyGems Betroffen| = 2.1.1 Behoben| 2.1.2 Zusammenfassung Rack::Session::Cookie mit secrets: sollte nur...

CVE-2025-46817-PoC

CVE-2025-46817 Redis Integer Overflow Exploit Eine schlanke C-Implementierung des Exploits für die Redis-Integer-Overflow-Schwachstelle CVE-2025-46817. 🚀 Funktionen Schlank : Einzelne C-Datei, keine externen Abhängigkeiten außer hiredis Schnell : Native Kompilierung für maximale Leistung Farbige...

CVE-2026-31431

CVE-2026-31431 — „Copy Fail“ Lokale Privilegieneskalation im Linux-Kernel-Krypto-algifaead-Subsystem. Überblick CVE-2026-31431, genannt „Copy Fail“, ist ein Logikfehler in der kryptografischen Vorlage authencesn des Linux-Kernels algifaead. Er ermöglicht einem nicht privilegierten lokalen Benutze...

CVE-2026-31431-CopyFail-Universal-LPE

CVE-2026-31431 „Copy Fail“ — Universeller LPE-Exploit Linux-Kernel-Page-Cache 4-Byte-Arbitrary-Write → Lokale Privilegieneskalation Mehrere Exploit-Ansätze: dynamische ELF-Einstiegspunkt-Überschreibung, vollständiger Binärersatz, Python 3.x-kompatibel mit ctypes-splice-Fallback. Was ist das?...

MicroburstSecretsHunter

MicroBurst Secrets Hunter Ein PowerShell-Scanner, der MicroBurst-Ausgaben von Get-AzDomainInfo nach Klartext-Passwörtern, Schlüsseln, Verbindungszeichenfolgen und anderen Geheimnissen durchsucht, die niemals unverschlüsselt in einer Azure-Umgebung liegen sollten. Entwickelt für...

ApplicationInspector v1.10.1

Introduction Microsoft Application Inspector is a software source code characterization tool that helps identify coding features of first or third party software components based on well-known library/API calls and is helpful in security and non-security use cases. It uses hundreds of rules and...

Exploit for CVE-2026-18963

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detecto...

Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation

= doi.org/10.5281/zenodo.18413764 = orcid.org/0009-0007-7728-256X root@kitploit: README.md CVE-2026-0628: Chromium WebView Privilege Escalation Origin Spoofing – Technische Forschung & Proof-of-Concept Autor: Sastra Adi Wiguna Purple Elite Teaming Forschungsdatum: Januar 2026 CVE-ID: CVE-2026-062...

CVE-2026-33715

CVE-2026-33715 — SSRF non autenticato + Open Email Relay in Chamilo LMS tramite install.ajax.php Gravità : Alta CVSS 7.5 CWE : CWE-918 SSRF + CWE-306 Autenticazione mancante Interessati : chamilo/chamilo-lms 2.0 commit 0195b29 e precedenti Advisory : GHSA-mxc9-9335-45mc NVD :...