nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

hacktronian

Pentesing Tools That All Hacker Needs. HACKTRONIAN Menu : Information Gathering Password Attacks Wireless Testing Exploitation Tools Sniffing & Spoofing Web Hacking Private Web Hacking Post Exploitation Install The HACKTRONIAN Information Gathering: Nmap Setoolkit Port Scanning Host To IP wordpre...

Exploit for Use After Free in Microsoft

CVE-2026-68820 — Mass Exploit Framework Edition. Automated modu...

domainhunter

Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

Important: Red Hat Security Advisory: ignition security update

An update for ignition is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

tofu

tofu A modular tool for hacking offline Windows filesystems and bypassing login screens. Can do hashdumps, OSK-Backdoors, user enumeration and more. How it works : When a Windows machine is shut down, unless it has Bitlocker or another encryption service enabled, it's storage device contains...

WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass vulnerability

Unauthenticated Improper Input Validation to Price Bypass vulnerability discovered by Andrés Cruciani in WordPress Plugin Advanced Product Fields Product Addons for WooCommerce versions = 1.6.21...

elevationstation

Elevation Station Stealing and Duplicating SYSTEM tokens for fun & profit! We duplicate things, make twin copies, and then ride away. You have used Metasploit's getsystem and SysInternals PSEXEC for getting system privs, correct? Well, here's a similar standalone version of that...but without the...

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

GHSA-M2PC-3Q4Q-W6JR reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

CVE-2026-21018-OPC-UA-Authentication-Bypass-via-None-Security-Policy

CVE-2026-21018 – OPC UA Authentifizierungsumgehung über die None-Sicherheitsrichtlinie Programmcode Python-opcua-asyncio-Simulator root@kitploit: opcuaserversim.py - OPC UA server accepting None security policy from asyncua import Server import asyncio async def main: server = Server await...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: autorizzazione mancante sugli endpoint dei plugin Docker → RCE sull'host Prova di concetto per CVE-2026-44848 , una vulnerabilità di autenticazione mancante CWE-862 in Portainer che consente a un utente non amministratore con accesso all'endpoint Docker di eseguire...

CVE-2019-7609

CVE-2019-7609 Le versioni di Kibana precedenti alla 5.6.15 e alla 6.6.1 contengono una falla di esecuzione arbitraria di codice nel visualizzatore Timelion. Un attaccante con accesso all'applicazione Timelion potrebbe inviare una richiesta che tenta di eseguire codice javascript. Ciò potrebbe...

Important: Red Hat Security Advisory: Kiali 2.4.22 for Red Hat OpenShift Service Mesh 3.0

Kiali 2.4.22 for Red Hat OpenShift Service Mesh 3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-22002-VNC-Authentication-Bypass-via-Protocol-Version-Confusion

CVE-2026-22002 – Bypass dell'autenticazione VNC tramite confusione sulla versione del protocollo Codice del programma Python root@kitploit: vncserversim.py - VNC server with version negotiation flaw import socket, struct def handleconn: Send server version "RFB 003.008\n" conn.sendb"RFB 003.008\n...

CVE-2026-47624

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...

wa-tunnel

wa-tunnel - TCP Tunneling through Whatsapp This is a Baileys based piece of code that lets you tunnel TCP data through two Whatsapp accounts. This can be usable in different situations, for example network carriers that give unlimited whatsapp data or airplanes where you also get unlimited social...

maigret v0.6.5

Maigret English · 简体中文 Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors IPcook provides reliable residential proxies for online...

CVE-2023-32315

CVE-2023-32315 Openfire Console Authentifizierungs-Bypass-Schwachstelle mit RCE Plugin Einrichtung root@kitploit: git clone https://github.com/miko550/CVE-2023-32315.git cd CVE-2023-32315 pip3 install -r requirements.txt Verwendung root@kitploit: python3 CVE-2023-32315.py -t http://127.0.0.1:9090...