Lucene search
+L

2480 matches found

CVE
CVE
•added 2026/09/24 6:42 p.m.•25 views

CVE-2026-86858

An improper access control security issue exists in the ServiceNow AI Platform , which could allow an unauthenticated user to create, modify, or delete instance data beyond intended limits. The CVELIST document specifies this as an Unauthenticated Privilege Escalation via GraphQL . ServiceNow rel...

8.7CVSS5.7AI score0.00273EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/24 6:42 p.m.•9 views

EUVD-2026-86395

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNo...

8.7CVSS5.7AI score0.00273EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/24 6:04 p.m.•16 views

CVE-2026-77294

The collaborative travel planner TREK is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 3.3.0 . When the LLM_PARSING feature is enabled, an authenticated user with write permissions to a trip instance can store an attacker-controlled llm_base_url via the settings API. The...

8.1CVSS5.8AI score0.00308EPSS
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
•added 2026/09/24 1:16 p.m.•7 views

Malicious code in simple-date-formatter-new-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
•added 2026/09/24 11:53 a.m.•11 views

CVE-2025-68613-n8n-lab

CVE-2025-68613 Local n8n Lab This repository provides a simple Docker Compose setup that runs a vulnerable n8n instance for local testing of CVE-2025-68613. Requirements Docker Desktop or Docker Engine Docker Compose v2 Quick start 1. Start the container: root@kitploit: docker compose up -d 2. Op...

9.9CVSS8.7AI score0.98994EPSS
SaveExploits33
Kitploit
Kitploit
•added 2026/09/23 10:55 p.m.•11 views

CVE-2023-22515

1vere$k CVE-2023-22515 iveresk-CVE-2023-22515 El 4 de octubre de 2023, Atlassian publicó un aviso para CVE-2023-22515, una vulnerabilidad crítica que afecta a instancias locales de Confluence Server y Confluence Data Center. Atlassian describió inicialmente esta vulnerabilidad como una Escalada d...

10CVSS9AI score0.99156EPSS
SaveExploits40
RedHat Linux
RedHat Linux
•added 2026/09/23 10:13 p.m.•6 views

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read view the instance group,...

5.7AI score
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2026/09/23 9:13 p.m.•8 views

automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS5.7AI score0.00337EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2026/09/23 9:13 p.m.•10 views

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read view the instance group,...

5.7AI score
SaveExploits0References4
NVD
NVD
•added 2026/09/23 8:17 p.m.•8 views

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS0.00337EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
•added 2026/09/23 7:40 p.m.•5 views

CVE-2026-84712 Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS5.7AI score0.00337EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
•added 2026/09/23 7:15 p.m.•5 views

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS5.7AI score0.00337EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/22 4:17 p.m.•34 views

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

7.1CVSS0.00263EPSS
SaveExploits0References4
Kitploit
Kitploit
•added 2026/09/22 9:27 a.m.•7 views

CVE-2023-4220

RCE para Chamilo LMS CVE-2023-4220 utilizando una Web Shell Este proyecto automatiza la explotación de la vulnerabilidad de ejecución remota de código CVE-2023-4220 encontrada en Chamilo LMS. Utilizando una web shell, la herramienta facilita la explotación automatizada de la vulnerabilidad para...

8.1CVSS7.5AI score0.76084EPSS
SaveExploits26References1
Kitploit
Kitploit
•added 2026/09/22 4:11 a.m.•14 views

cve-2018-15961

CVE-2018-15961 Esto es parte de Cved: una herramienta para gestionar contenedores Docker vulnerables. Cved: https://github.com/git-rep-src/cved Fuente de la imagen: https://github.com/cved-sources/cve-2018-15961 Autor de la imagen: https://bintray.com/eaps/coldfusion/cf%3Acoldfusion/2018.0.0...

10CVSS8.7AI score0.9995EPSS
SaveExploits11References2
Broadcom
Broadcom
•added 2026/09/22 12:00 a.m.•6 views

Nginx Out-of-band Security Notification (July 15, 2026)

NGINX Security Advisory: NGINX Ingress Controller vulnerability CVE-2026-55723 NGINX Ingress Controller NGINX Ingress Controller vulnerability CVE-2026-52865 NGINX Ingress Controller NGINX Agent vulnerability CVE-2026-60062 NGINX Agent, NGINX Instance Manager NGINX map directive and regex matchin...

9.2CVSS7.2AI score0.00894EPSS
SaveExploits6
Kitploit
Kitploit
•added 2026/09/21 4:51 p.m.•15 views

security-research

security-research Proof-of-concept code and technical write-ups for vulnerabilities I discovered and reported through coordinated disclosure. Every entry here is already public: the vendor advisory is published and a fixed release is available. Nothing under embargo or in draft is included. The...

6AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/21 4:47 p.m.•8 views

CVE-2022-29221-PoC

CVE-2022-29221-PoC Ya no alojo en Github, sino en mi propia instancia de alojamiento Git. Ve aquí para ver el código: https://git.sbani.net/sbani/CVE-2022-29221-PoC...

8.8CVSS6.9AI score0.04914EPSS
SaveExploits1
Kitploit
Kitploit
•added 2026/09/21 3:44 p.m.•15 views

CVE-2025-31161_exploit

CVE-2025-31161 / CVE-2025-2825 exploit en Python Para procesar una sola URL, use el comando: python3 script.py -u http://example.com Para procesar un archivo que contenga una lista de URLs una por línea, use el comando: python3 script.py -l urls.txt Para especificar el número de hilos, use el fla...

9.8CVSS8.6AI score0.99976EPSS
SaveExploits22
Kitploit
Kitploit
•added 2026/09/21 3:43 p.m.•10 views

CVE-2020-0609

CVE-2020-609-POC Ejecutar el PoC contra un servidor RDG con UDP abierto en el puerto 3391 provocará que la instancia de RDG se bloquee. Gracias a @Ollypwn por sparring durante el desarrollo...

10CVSS8.5AI score0.77679EPSS
SaveExploits12
Rows per page
Query Builder