NetAlertX v26.9.0

NetAlertX - Network Visibility & Asset Intelligence Framework 📷 Click for more screenshots | | ---|---|--- | | | | Head to https://netalertx.com/ for even more gifs and screenshots 📷. NetAlertX is a network visibility and asset intelligence platform for homelabs, IT teams, MSPs, and distributed...

vault v2.1.0

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

reconftw v5.0.0-beta.1

reconFTW reconFTW is a powerful automated reconnaissance tool designed for security researchers and penetration testers. It streamlines the process of gathering intelligence on a target by performing subdomain enumeration, vulnerability scanning, OSINT and more. With a modular design, extensive...

SUSE CVE-2026-83615

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses copy to clone the complete currentNSMap for each nested element...

bromure agentic-coding-v4.6.0

Bromure Secure, ephemeral computing in disposable Linux VMs on macOS. → Full details, screenshots, and downloads at bromure.io This repo ships two sibling apps, both built on Apple's Virtualization.framework: Bromure — every browser session runs in a throwaway Linux VM. Close the window, the VM i...

PT-2026-84855

Name of the Vulnerable Software and Affected Versions Hermes version 0.21.0 Description An issue exists where coding agents execute git status or git diff for context gathering before trust prompts are presented to the user. If a repository is delivered as files such as via zip, sync, or USB rath...

nodejs:22 security update

nodejs 1:22.23.2-1 - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-235693 RHEL-235688 RHEL-235662 nodejs-nodemon 3.1.14-2 - Rebase npm/brace-expansion to 5.0.9 Fixes: CVE-2026-69152 Resolves: RHEL-223760 3.1.14-1 - Rebase to 3.1.14 - Switch from usin...

Fedora 43 : bubblewrap (2026-96e0765328)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-96e0765328 advisory. Update to 0.12.0 Fixes GHSA-pxhw-h44j-8pfx Reset disposition of SIGCHLD, restoring normal subprocess management if bwrap1 was run from a process that was...

The vulnerability of the l2tp_eth_create() function in the net/l2tp/l2tp_eth.c module of the Linux operating system’s L2TP protocol implementation allows a attacker to increase their privileges.

The vulnerability of the l2tpethcreate function in the net/l2tp/l2tpeth.c module of the L2TP protocol implementation in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

Marimo 0.20.4 - RCE

Title: Marimo 0.20.4 - RCE Date: August 2nd, 2026 Exploit Author: Jason Bernier Vendor Homepage: https://marimo.io/ Software Link: https://github.com/marimo-team/marimo Version: str: """Send command to target and receive output""" try: if not conn: print"- No active connection" return ""...

ROS-20260902-73-0018

The vulnerability of the functions IndexFile.checkout and TagReference.create in the GitPython library for interacting with git repositories is related to an incorrect path name limitation when processing the kwargs parameter. Exploiting this vulnerability could allow a malicious actor to gain...

The vulnerability of the Git repository management system Gitea, related to insufficient validation of server-side requests, allows a hacker to execute a SSRF attack.

The vulnerability of the Git repository management system Gitea is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform a SSRF attack remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-76642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post- mount hooks, allowing unprivileged users to execute...

ROS-20260902-73-0017

The vulnerability of the Repo.archive function in the Python library for interacting with Git repositories in GitPython is related to improper external handling of file names or paths when processing the unsafegitarchiveoptions parameter. Exploiting this vulnerability may allow a remote attacker ...

Langflow 1.10.0 - RCE

Exploit Title: Langflow 1.10.0 - RCE Exploit Author: Richard Howe Vendor Homepage: https://www.langflow.org/ Software Link: https://www.langflow.org/desktop Version: str: endpoint = '/api/v1/autologin' headers = 'Content-Type': 'application/json', try: resp = getbaseurl + endpoint except Exceptio...

snuffleupagus v0.14.0

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

CVE-2026-84359

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

yolobox v0.19.4

root@kitploit: ██╗ ██╗ ██████╗ ██╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗ ╚██╗ ██╔╝██╔═══██╗██║ ██╔═══██╗██╔══██╗██╔═══██╗╚██╗██╔╝ ╚████╔╝ ██║ ██║██║ ██║ ██║██████╔╝██║ ██║ ╚███╔╝ ╚██╔╝ ██║ ██║██║ ██║ ██║██╔══██╗██║ ██║ ██╔██╗ ██║ ╚██████╔╝███████╗╚██████╔╝██████╔╝╚██████╔╝██╔╝ ██╗ ╚═╝ ╚═════╝ ╚══════╝...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the compile and merge functions in lib/messages.js, where a language key named proto or constructor in a user-supplied messages object causes writes to flow onto Object.prototype rather than the intended target...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the rename method. An attacker can manipulate the prototype of the validated object by supplying specially crafted input keys that are interpreted as proto, leading to unintended property inheritance or behavior i...