net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

Security update for php7

This update for php7 fixes the following issue: CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. Other changes: Allow removal of apache2-modphp7 even if the php7 module is not enabled bsc1205782, bsc1276531. Patch Instructions: To install this SUSE update use the SUSE...

Security update for tomcat

This update for tomcat fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues: CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276733. CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issu...

POC-CVE-2026-56164-exploit

CVE-2026-56164 — Exploit de omisión de autenticación en Microsoft SharePoint Server Crítico CVSS 9.8 — Escalada de privilegios no autenticada a Administrador de granja en Microsoft SharePoint Server Tabla de contenidos Descripción general Detalles de la vulnerabilidad Versiones afectadas Diagrama...

pdbdownload

Una utilidad para descargar archivos PDB asociados a un Portable Executable PE. Características Descargar símbolos PDB de msdl.microsoft.com. Procesar un solo archivo PortableExecutable PE o un lote de ellos. Demostración...

ffufw

ffufw ffuf con esa salsa especial Instalación root@kitploit: go install github.com/puzzlepeaches/ffufw@latest ¿Por qué? ffufw es un envoltorio de ffuf que hace que el ataque de fuerza bruta a directorios sea más fácil e inteligente. La herramienta tiene las siguientes características: Ejecución...

Exploit for CVE-2026-82222

CVE-2026-82222 — GiveWP Unauthenticated PHP Object Injection →...

No-Consolation

No-Consolation Este es un archivo de objeto Beacon BOF que ejecuta PE no administrados en línea y recupera su salida sin asignar una consola es decir, sin generar conhost.exe. Características Soporta 64 y 32 bits Soporta EXEs y DLLs No crea nuevos procesos No crea nuevos hilos Vincula módulos al...

TokenStealer

TokenStealer Una herramienta sencilla que escribí hace un tiempo para robar y jugar con tokens de Windows. Partes del código se han tomado y adaptado de https://github.com/FSecureLABS/incognito Claramente, necesitarás el privilegio de Impersonación o AssignPrimary y el privilegio de Debug para...

SelectMyParent

What's this This is a project for parent process spoofing. How to use step 1:Select a parent process and remember the pid Step 2:Execute the following command. Implement parent process spoofing root@kitploit: SelectMyParent.exe notepad 928 Step 3:Using process explorer to view the process tree, y...

Pentest-Command

项目背景 在渗透测试过程中我们会使用到各类的框架，例如:MSF、CS、Empire、Impacket等，本项目的主要目的是收录在后渗透测试阶段中常用到的命令 基础知识 Windows目录介绍 a、开机启动程序目录c C:\Users\Al1ex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup root@kitploit: b、开机自启动程序该特色常被用于进行权限维持c C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup c. System...

Red-Team

Resumen del proyecto El proyecto se utiliza para recopilar y resumir los siguientes aspectos del Red Team: Mentalidad de ataque del Red Team Herramientas de ataque del Red Team Métodos de ataque del Red Team Contenido esencial https://mitre-attack.github.io/ wiki de MITRE con el resumen de técnic...

potential-cassandra

CVE-2024-23114 Prepare the enviroment We'll need a Mysql instance docker run --rm -d --name cassandra -p 9042:9042 cassandr Now we'll need to create the required tables: You have two files: employee.sql and employeecompleted.sql Run the following command: root@kitploit: docker exec -it cassandra...

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center FMC vulnerabilities. The attacks leverage CVE-2026-20079 CVSS score: 10.0, an authentication bypass vulnerability in...

Xjar_tips

Xjartips Introduction: root@kitploit: Spring Boot JAR 安全加密运行工具, 同时支持的原生JAR. 基于对JAR包内资源的加密以及拓展ClassLoader来构建的一套程序加密启动, 动态解密运行的方案, 避免源码泄露以及反编译. 功能特性 无代码侵入, 只需要把编译好的JAR包通过工具加密即可. 完全内存解密, 降低源码以及字节码泄露或反编译的风险. 支持所有JDK内置加解密算法. 可选择需要加解密的字节码或其他资源文件. 支持Maven插件, 加密更加便捷. 动态生成Go启动器, 保护密码不泄露. 其中xjar...