Metasploit Wrap Up: An HTTP to SMB relay plus Payload Improvements

Metasploit Wrap Up Housekeeping While the Metasploit Framework will be continuing its weekly release cadence, bringing you dear reader our latest content, the Weekly Wrap Up is being shifted to a bi-weekly cadence. The team is planning to use the additional time between posts to record demos of...

CVE-2026-48022: Cleartext Transmission of Sensitive Information

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact...

kumactl connects to control plane without verifying TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...

CVE-2026-55576

creationtimestamp| type| source ---|---|--- 2026-07-16 00:07:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpwwfqvfb2l...

CVE-2026-15925: Improper Validation of Certificate with Host Mismatch

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...

CVE-2026-52842

creationtimestamp| type| source ---|---|--- 2026-07-15 16:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp62iew3x2w 2026-07-15 19:15:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgm3qmkx2s...

Malicious Package

Overview gta5rp-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to t...

Uncaught Exception

Overview std/net is a Go standard library package std/net Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report:Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Remediation Upgrade std/net to...

CVE-2026-51105

creationtimestamp| type| source ---|---|--- 2026-07-14 15:43:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkcoi4r42e 2026-07-22 05:03:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kb2qcoe24...

XenServer Security Update for CVE-2026-42491

Severity: Medium Description of Problem An issue has been identified in the XenServer management API SDK that may allow an attacker on the management network who is able to intercept specific HTTPS requests within a higher-level operation to be able to act with the privileges of the intercepted...

PT-2026-58855

Name of the Vulnerable Software and Affected Versions Citrix XenServer SDK versions prior to 26.15.0 XenCenter versions prior to 2026.4.0 Description Some SDKs lack proper TLS verification during network communication with a host running XAPI. This flaw allows an attacker to perform a...

Improper Certificate Validation

Overview DIRAC is an interware, meaning a software framework for distributed computing. Affected versions of this package are vulnerable to Improper Certificate Validation in the process that downloads and executes the second stage pilot script over an unverified HTTPS connection. An attacker can...

PYSEC-2026-2424 compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

Summary The compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path traversal sequences ../. When a remote OSCAL profile references a URL with traversal in its path, the HTTP...

Malicious code in mcp-notes-server-poc-praetorian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...

Malicious code in tinyparrot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9 The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays v...

FTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline

Fetch and execute an x86 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)

Fetch and execute an x64 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)

Fetch and execute an x64 payload from an FTP server. Tunnel communication over HTTPS Windows x64 winhttp Module Options...

HTTPS Fetch, Linux dup2 Command Shell, Reverse TCP Stager

Fetch and execute an RISC-V 32-bit payload from an HTTPS server. dup2 socket in s1, then execve. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

CVE-2026-53448 Coturn: SQL Injection in HTTPS Admin Panel Delete Operations

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The issecurestring filter that protects the STUN protocol path is not...