CVE-2026-82289 Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-82289

Gitingest (through 0.3.1 ) has a flaw in its _validate_host function that accepts any hostname with a git. , gitlab. , or github. prefix without verifying membership in a known-hosts list. An attacker can supply a URL with a crafted hostname (e.g., github.evil.com), causing the application to ope...

GHSA-JW39-3688-R4RX Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

KubeVela Terraform remote loader DoS via unbounded file read

Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...

GHSA-FMGP-Q6JX-GG3X KubeVela Terraform remote loader DoS via unbounded file read

Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...

GHSA-2VH6-HW4J-32WW gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

Summary gix-packetline panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the gix client process during a normal fetch. This is a pre-authentication,...

gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

Summary gix-packetline panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the gix client process during a normal fetch. This is a pre-authentication,...

Exploit for Path Traversal in Jfrog Artifactory

cve-id Donate Help maintain this project...

cve-2018-2894

Vulnerabilità di upload arbitrario di file in Weblogic CVE-2018-2894 Ultimamente tutti parlano di questa vulnerabilità, tutti hanno notato che il problema si verifica su config.do, ma in realtà secondo https://mp.weixin.qq.com/s/y5JGmM-aNaHcs6P9a-gRQ le informazioni qui, anche begin.do è...

smart-contract-security-training

Smart Contract Security Training Hands-on smart contract secu...

CVE-2024-2997

CVE-2024-2997 स्कैनर अवलोकन CVE-2024-2997 स्कैनर एक उन्नत भेद्यता स्कैनर है जिसे वेब अनुप्रयोगों में कमांड इंजेक्शन भेद्यता का पता लगाने के लिए डिज़ाइन किया गया है। यह उपकरण सुरक्षा पेशेवरों को उनके अनुप्रयोगों में संभावित सुरक्षा जोखिमों की पहचान करने में मदद करता है। अस्वीकरण यह उपकरण केवल...

CVE-2023-36845-Juniper-Vulnerability

CVE-2023-36845 Este script fornece uma Prova de Conceito PoC automatizada para CVE-2023-36845, uma vulnerabilidade que afeta o Junos OS da Juniper Networks em dispositivos das séries EX e SRX. Ela explora o componente J-Web, permitindo a modificação remota da variável PHPRC e potencial injeção de...

CVE-2018-7600

CVE-2018-7600 Solo funzionante sulla versione 8, non sulla 7. Installazione root@kitploit: git clone https://github.com/0xAJ2K/CVE-2018-7600.git pip3 install -r requirements.txt python3 CVE-2018-7600.py Utilizzo root@kitploit: python3 CVE-2018-7600.py -u http://172.31.1.27 Output previsto...

bitbucket-test

Container Docker per investigare CVE-2022-36804 Ricreazione di una vulnerabilità di esecuzione remota di codice in cui Bitbucket non sanifica l'input dell'utente, consentendo agli attaccanti di iniettare flag Git ed eseguire codice in remoto. Questo repository documenta come ho riprodotto la...

ubuntu-privesc-lab

ubuntu-privesc-lab Flusso di lavoro completo di penetration testing: brute force delle credenziali, accesso SSH ed escalation dei privilegi CVE-2021-4034 PANORAMICA Questo progetto dimostra un flusso di lavoro completo di penetration testing contro una macchina virtuale Ubuntu vulnerabile. La...

BIT-GITEA-2026-60004

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...

CVE-2022-35650

CVE-2022-35650 Questa è una lettura arbitraria di file in Moodle. Prerequisiti Devi aver compromesso un utente a livello di insegnante o amministratore. Passaggi 1. Clona questo repository: root@kitploit: git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git 2. Esegui questo comando per...

CVE-2026-46300

CVE-2026-46300 Linux-Kernel-Root-Exploit root@kitploit: git clone https://github.com/ExploitEoom/CVE-2026-46300.git chmod +x exploit ./exploit...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...