Lucene search
+L

2480 matches found

CVE
CVE
•added 2026/09/24 6:42 p.m.•25 views

CVE-2026-86858

An improper access control security issue exists in the ServiceNow AI Platform , which could allow an unauthenticated user to create, modify, or delete instance data beyond intended limits. The CVELIST document specifies this as an Unauthenticated Privilege Escalation via GraphQL . ServiceNow rel...

8.7CVSS5.7AI score0.00273EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/24 6:42 p.m.•9 views

EUVD-2026-86395

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNo...

8.7CVSS5.7AI score0.00273EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/24 6:04 p.m.•16 views

CVE-2026-77294

The collaborative travel planner TREK is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 3.3.0 . When the LLM_PARSING feature is enabled, an authenticated user with write permissions to a trip instance can store an attacker-controlled llm_base_url via the settings API. The...

8.1CVSS5.8AI score0.00308EPSS
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
•added 2026/09/24 1:16 p.m.•8 views

Malicious code in simple-date-formatter-new-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
•added 2026/09/24 11:53 a.m.•11 views

CVE-2025-68613-n8n-lab

CVE-2025-68613 本地 n8n 实验环境 本仓库提供了一个简单的 Docker Compose 配置,用于运行一个存在漏洞的 n8n 实例,以便在本地测试 CVE-2025-68613。 环境要求 Docker Desktop 或 Docker Engine Docker Compose v2 快速开始 1. 启动容器: root@kitploit: docker compose up -d 2. 在浏览器中打开 n8n: http://localhost:5678 3. 使用 docker-compose.yml 中设置的默认凭据登录: 用户名:admin...

9.9CVSS8.8AI score0.98994EPSS
SaveExploits33
Kitploit
Kitploit
•added 2026/09/23 10:55 p.m.•11 views

CVE-2023-22515

1vere$k CVE-2023-22515 iveresk-CVE-2023-22515 2023年10月4日,Atlassian 发布了关于 CVE-2023-22515 的安全公告,这是一个影响 Confluence Server 和 Confluence Data Center 本地实例的严重漏洞。 Atlassian 最初将此漏洞描述为权限提升漏洞,但后来已将其重新归类为访问控制失效漏洞。 此处是其源文章。 root@kitploit: echo...

10CVSS9AI score0.99156EPSS
SaveExploits40
RedHat Linux
RedHat Linux
•added 2026/09/23 10:13 p.m.•6 views

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read view the instance group,...

5.7AI score
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2026/09/23 9:13 p.m.•8 views

automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS5.7AI score0.00337EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2026/09/23 9:13 p.m.•10 views

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read view the instance group,...

5.7AI score
SaveExploits0References4
NVD
NVD
•added 2026/09/23 8:17 p.m.•8 views

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS0.00337EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
•added 2026/09/23 7:40 p.m.•5 views

CVE-2026-84712 Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS5.7AI score0.00337EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
•added 2026/09/23 7:15 p.m.•5 views

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS5.7AI score0.00337EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/22 4:17 p.m.•34 views

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

7.1CVSS0.00263EPSS
SaveExploits0References4
Kitploit
Kitploit
•added 2026/09/22 9:27 a.m.•7 views

CVE-2023-4220

使用Web Shell对Chamilo LMS CVE-2023-4220进行远程代码执行 本项目自动利用Chamilo LMS中的远程代码执行漏洞(CVE-2023-4220)。通过Web Shell,该工具可自动化利用该漏洞,从而控制受影响的Chamilo LMS实例。 功能: 自动化利用CVE-2023-4220 Web Shell集成 演示漏洞的影响 用法/示例 root@kitploit: ./exploit.py -t http://example.com 截图 免责声明: 此工具仅用于教育目的,并帮助安全专业人员理解和缓解漏洞。未经许可擅自用于系统是非法且不道德的。 🔗 链...

8.1CVSS7.5AI score0.76084EPSS
SaveExploits26References1
Kitploit
Kitploit
•added 2026/09/22 4:11 a.m.•14 views

cve-2018-15961

CVE-2018-15961 这是 Cved 的一部分: 一个用于管理易受攻击的 Docker 容器的工具。 Cved: https://github.com/git-rep-src/cved 镜像来源:https://github.com/cved-sources/cve-2018-15961 镜像作者:https://bintray.com/eaps/coldfusion/cf%3Acoldfusion/2018.0.0...

10CVSS8.7AI score0.9995EPSS
SaveExploits11References2
Broadcom
Broadcom
•added 2026/09/22 12:00 a.m.•6 views

Nginx Out-of-band Security Notification (July 15, 2026)

NGINX Security Advisory: NGINX Ingress Controller vulnerability CVE-2026-55723 NGINX Ingress Controller NGINX Ingress Controller vulnerability CVE-2026-52865 NGINX Ingress Controller NGINX Agent vulnerability CVE-2026-60062 NGINX Agent, NGINX Instance Manager NGINX map directive and regex matchin...

9.2CVSS7.2AI score0.00894EPSS
SaveExploits6
Kitploit
Kitploit
•added 2026/09/21 4:51 p.m.•15 views

security-research

security-research Proof-of-concept code and technical write-ups for vulnerabilities I discovered and reported through coordinated disclosure. Every entry here is already public: the vendor advisory is published and a fixed release is available. Nothing under embargo or in draft is included. The...

6AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/21 4:47 p.m.•8 views

CVE-2022-29221-PoC

CVE-2022-29221-PoC 我不再在 Github 上托管,而是托管在我自己的 Git 托管实例上。 前往此处查看代码:https://git.sbani.net/sbani/CVE-2022-29221-PoC...

8.8CVSS6.9AI score0.04914EPSS
SaveExploits1
Kitploit
Kitploit
•added 2026/09/21 3:44 p.m.•15 views

CVE-2025-31161_exploit

CVE-2025-31161 / CVE-2025-2825 Python 漏洞利用程序 要处理单个URL,请使用以下命令: python3 script.py -u http://example.com 要处理包含URL列表的文件(每行一个),请使用以下命令: python3 script.py -l urls.txt 要指定线程数,请使用 -t 参数。 脚本的运行结果(响应中包含 crushadmin 字符串的URL)将写入 output.txt 文件。...

9.8CVSS8.6AI score0.99976EPSS
SaveExploits22
Kitploit
Kitploit
•added 2026/09/21 3:43 p.m.•10 views

CVE-2020-0609

CVE-2020-609-POC 对开启了UDP端口3391的RDG服务器运行PoC,将导致RDG实例崩溃。 感谢@Ollypwn在开发过程中的切磋。...

10CVSS8.6AI score0.77679EPSS
SaveExploits12
Rows per page
Query Builder