CVE-2026-85732

A flaw was found in oras-go, a Go library for managing OCI artifacts. This vulnerability allows a remote attacker to perform blind Server-Side Request Forgery SSRF against internal services by providing a specially crafted Link header URL during pagination operations. Although the response body i...

Security Bulletin: IBM Informix HQ is affected by multiple security vulnerabilities due to Hono (CVE-2026-54286, CVE-2026-54287, CVE-2026-54288, CVE-2026-54289, CVE-2026-54290).

Summary IBM Informix HQ is affected by multiple vulnerabilities in Hono. To address these vulnerabilities, IBM Informix HQ has been updated to the latest version of Hono. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any...

Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

MAL-2026-16240 Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

CVE-2026-33693

CVE-2026-33693: activitypub-federation-rust の v4isinvalid における 0.0.0.0 バイパスによる SSRF CVSS 6.5 中 キーワード: SSRF, 0.0.0.0, IP 検証バイパス, activitypub-federation, Lemmy, Rust, ActivityPub 目次 概要 脆弱性の詳細 技術的分析 攻撃チェーン 影響 対策 CVSS v3.1 メトリクス タイムライン 参考情報 連絡先 免責事項 概要 activitypub-federation-rust ライブラリ Lemmy および 6...

Popcorn-TJNULL-OSCP-

HackTheBox: Popcorn 라이트업 날짜: 2026년 6월 5일 난이도: 쉬움 플랫폼: HackTheBox 주요 기술: 포트 및 서비스 열거, 디렉터리 퍼징 Gobuster, 파일 업로드 우회, HTTP 요청 조작 Burp Suite, 원격 코드 실행 RCE, 고급 TTY 셸 안정화 Python, 로컬 커널/PAM 익스플로잇 MOTD 파일 변조. 1. 정찰 및 열거 포트 스캔 빠른 정찰 모든 65,535개 포트에 대해 빠른 TCP 포트 스캔-p-을 수행하여 열린 진입점을 찾습니다. 감사 환경에서 프로세스를 간소화하기...

CVE-2025-14733

WatchGuard IKEv2 スキャナー — CVE-2025-14733 CVE-2025-14733 に脆弱な WatchGuard Firebox アプライアンスを特定します。これは Fireware OS の IKEv2 実装における重要な事前認証の脆弱性です。 このツールは標準の IKEv2 ネゴシエーションを通じて安全にバージョン検出を行います。悪用を試みるものではありません。 必要条件 Python 3.8 以上 外部依存関係はありません。 使用方法 root@kitploit: Single host python3 CVE-2025-14733-Scanner.py...

iron-proxy

iron-proxy The problem CI jobs, AI coding agents, and sandboxed containers can make arbitrary outbound requests. A compromised dependency, a prompt injection, or a malicious build step can exfiltrate secrets, phone home, or open a reverse shell. Most teams have zero visibility into what's leaving...

reconkg

reconkg A vulnerability triage tool. It takes what a scan already found, works out which CVEs plausibly apply, tells you how confident it is and why, and gives you the commands to check for yourself. It does not scan anything, and it does not exploit anything. Install on Kali root@kitploit: git...

arp-scan

arp-scan About arp-scan is a network scanning tool that uses the ARP protocol to discover and fingerprint IPv4 hosts on the local network. It is available for Linux, BSD, macOS and Solaris under the GPLv3 licence. This is README.md for arp-scan version 1.10.1-git. Installation Building and...

qemu

QEMU README QEMU는 범용 오픈 소스 머신 및 사용자 공간 에뮬레이터이자 가상화기입니다. QEMU는 하드웨어 가상화 지원 없이도 소프트웨어만으로 완전한 머신을 에뮬레이트할 수 있습니다. 동적 번역을 사용하여 매우 좋은 성능을 제공합니다. 또한 Xen 및 KVM 하이퍼바이저와 통합하여 에뮬레이트된 하드웨어를 제공하면서 하이퍼바이저가 CPU를 관리하도록 할 수 있습니다. 하이퍼바이저 지원을 통해 QEMU는 CPU에 대해 네이티브에 가까운 성능을 달성할 수 있습니다. QEMU가 CPU를 직접 에뮬레이트할 때는 한 머신예:...

POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — 任意ファイル書き込み + XMLインジェクション → リモートコード実行 目次 概要 脆弱性の詳細 攻撃チェーン 要件 インストール 設定 使用方法 動作の仕組み 脆弱性のあるコード 事前エクスプロイトチェックリスト テスト環境 免責事項 参考文献 概要 CVE-2025-66034 は、fontTools.varLib の可変フォント生成パイプラインにおける脆弱性です。Web アプリケーションがこのパイプラインを公開し、ユーザーが提供した .designspace...

CVE-2026-78301

A flaw was found in BIND, a widely used Domain Name System DNS software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own...

MAL-2026-16228 Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...

MAL-2026-16225 Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...

Malicious code in strapi-plugin-pysh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 188e8ecd93a0124135c178af848914dbd0f8cc7c3f9fdc7f5137fc94e46bb27d [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script uses...

MAL-2026-16239 Malicious code in strapi-plugin-pysh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 188e8ecd93a0124135c178af848914dbd0f8cc7c3f9fdc7f5137fc94e46bb27d [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script uses...

Malicious code in strapi-plugin-perev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host...