vim security update

An update is available for vim. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

RLSA-2026:66325 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset CVE-2025-68745 kernel: scsi: target: configfs: Bound snprintf return in...

CISA Malcolm

RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and...

CVE-2026-88046

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...

rosettaflash

Rosetta Flash CVE-2014-4671 Adobe Flash Player anterior a 13.0.0.231 y 14.x anterior a 14.0.0.145 en Windows y OS X, y anterior a 11.2.202.394 en Linux, Adobe AIR anterior a 14.0.0.137 en Android, Adobe AIR SDK anterior a 14.0.0.137, y Adobe AIR SDK & Compiler anterior a 14.0.0.137 no restringen...

postgres-bruteforcer

postgres-bruteforcer Acerca de Este script de Go lee una lista de nombres de usuario y contraseñas de un archivo llamado creds.txt y los prueba contra una base de datos PostgreSQL. El script acepta una IP del servidor PostgreSQL como argumento de línea de comandos o un archivo de texto con IPs. S...

r2rs

\ / / |/ //|/ \ | | / | | / || / | / / / / / / react2rubyshell !IMPORTANT 免责声明：因使用本脚本而采取的任何行动，其责任完全由执行者本人承担。请仅对您拥有或已获明确许可进行测试的系统使用本脚本。 环境要求 本地安装 Ruby Ruby 标准库：json、net/http、optparse、readline、securerandom、shellwords、uri 无需任何外部 gem。 安装 克隆仓库，进入项目目录，然后使用 Ruby 运行脚本： root@kitploit: git clone...

snuffleupagus

Snuffleupagus 适用于 php7 和 php8 的安全模块 - 消除 bug 类别并对其余进行虚拟补丁！ 主要特性 • 下载 • 示例 • 文档 • 许可证 • 致谢 Snuffleupagus 是一个 PHP 7+ 和 8+ 模块，旨在通过消除整个 bug 类别来大幅提高攻击网站的成本。它同时还提供了一个强大的虚拟补丁系统，使管理员无需修改 PHP 代码即可修复特定漏洞并审计可疑行为。 主要特性 无明显的性能影响 强大但易于编写的虚拟补丁规则 消除几类漏洞 基于反序列化的代码执行 基于 mail 的代码执行 窃取 Cookie 的 XSS 基于文件上传的代码执行 弱 PRN...

passgen

🔐 passgen — 从终端生成密码 一个小巧的 Go CLI 工具，能够生成带有灵活字符集和排除项的安全随机密码。 使用 crypto/rand 提供密码学安全随机性。如果未提供字符集标志，默认启用所有字符集。 安装 Go root@kitploit: latest go install github.com/bilalbaraz/passgen@latest specific version go install github.com/bilalbaraz/passgen@ Homebrew root@kitploit: brew tap bilalbaraz/tap brew...

elastic-search-email-extractor

Extractor de correos electrónicos Este programa en Go está diseñado para extraer direcciones de correo electrónico de una lista de bases de datos de Elastic Search. Recibe una lista de URLs y busca en la base de datos de cada URL para encontrar direcciones de correo electrónico. Instalación...

S3-from-csp

S3-from-csp Extrae todos los buckets S3 de las cabeceras de los informes CSP y luego prueba vulnerabilidades de subida de archivos Instalación root@kitploit: go install github.com/RandomRobbieBF/S3-from-csp@latest Ejecución root@kitploit: s3fromcsp file.txt...

csp-log4j

csp-log4j Finds CSP report urls and tests to see if they are vulnerable to log4j Install root@kitploit: go install github.com/randomrobbiebf/csp-log4j/ Run root@kitploit: csp-log4j -input file.txt -collab something.oastify.com...

local-mcp

local-mcp 零依赖的 MCP 服务器，用于本地文件操作。 13 个文件系统工具 + 3 个元工具用于渐进式发现 — 无需 SDK、无需框架、无需 npm install。 MCP 协议: 2024-11-05 · 传输: stdio + Streamable HTTP · 运行时: Node.js ≥ 22.0.0 架构 root@kitploit: local-mcp.mjs — 595 lines, 13 tools, entry point lib/mcp-core.mjs — 229 lines, stdio + HTTP transport, 9 MCP methods...

cupshax

CUPSHax Prueba de concepto rápida para el exploit reciente de CUPS. Planeaba pulirlo mucho más, pero el embargo se levantó mucho antes de lo esperado, así que el código está un poco apresurado. Para todos los detalles técnicos, honestamente deberías leer el artículo de Evilsocket. Este exploit fu...

promptfoo v0.123.0

Promptfoo: LLM evals & red teaming promptfoo is a CLI and library for evaluating and red-teaming LLM apps. Stop the trial-and-error approach - start shipping secure, reliable AI apps. Website · Getting Started · Red Teaming · Documentation · Discord Promptfoo is now part of OpenAI. Promptfoo...

arpspoof

ARP 欺骗 安装 root@kitploit: CGOENABLED=0 go install -ldflags "-s -w" -trimpath github.com/shadowy-pycoder/arpspoof/cmd/af@latest 用法 root@kitploit: af -h Usage of af: -I Display list of interfaces and exit. -d Enable debug logging -f Run ARP spoofing in fullduplex mode -g string IPv4 address of custo...

CVE-2026-50522

CVE-2026-50522 ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual...

Geutebruck - Remote Command Injection

Geutebruck is susceptible to multiple vulnerabilities its web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-33544 info: name: Geutebruck - Remote Command Injection author: gy741 severit...

Cisco IOS XE Web UI - Command Injection

A vulnerability in the web UI component of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to improper input validation in the web UI. An attacker could exploit...

pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection

pfSense pfBlockerNG through 2.1.426 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected. id: CVE-2022-31814 info: name: pfSense pfBlockerNG =2.1..427 to mitigate this vulnerability. reference: -...