434345 matches found
EUVD-2026-68392
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-82838 Default webserver configuration with incorrect CSP
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
wifit3 v0.0.5
wifit3: USB Wireless Auditor A wireless auditor that runs on Linux and Windows, comes with its own built-in drivers. At least one of the supported USB adapters is required. wifit3 is fundamentally different from its predecessor, wifite2: Only supports certain popular USB cards see Supported...
CVE-2026-53620
GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...
GoogleRecaptchaBypass — Updated!
Google Recaptcha Solver We love bots ❤️, but Google doesn't. So, here is the solution to bypass Google reCAPTCHA. Solve Google reCAPTCHA less than 5 seconds! 🚀 This is a Python script to solve Google reCAPTCHA using the DrissionPage library. Selenium implementation will be added soon. Recent...
EUVD-2026-68371
GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...
CVE-2026-53620
GROWI contains an authorization bypass (CWE-639) in the bookmark folder APIs , caused by a user-controlled key. An authenticated attacker can retrieve, tamper with, or delete another user's bookmark data. The CVSS 3.0 score is 6.3 (Medium) and CVSS 4.0 is 5.3 (Medium) , reflecting network vector,...
CVE-2026-53620
GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...
nightcrawler — Updated!
Nightcrawler An autonomous penetration testing agent that runs entirely on a smartphone. Drop the phone on a network, walk away, and it discovers hosts, maps services, finds vulnerabilities, and generates a pentest report — all without cloud connectivity. root@kitploit: ░█▄░█ █ █▀▀ █░█ ▀█▀ █▀▀ █▀...
CVE-2026-69242
A flaw was found in libvips. A crafted many-band TIFF image, when processed by libvips, can bypass scanline validation and trigger an integer overflow. This overflow leads to a heap buffer overflow, allowing an attacker to access arbitrary memory locations with negative offsets. This can result i...
CVE-2026-82621
A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses httpclient5-5.6.2.jar, aiohttp-3.13.4-cp311-cp311-manylinux2014x8664.manylinux217x8664.manylinux228x8664.whl, ip-address-10.2.0.tgz, datasets-3.6.0-py3-none-any.whl, jackson-databind-2.21.4.jar, keras-3.13.2-py3-none-any.whl, log4j-api-2.24.3.jar,...
CVE-2026-62243
A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...
BIT-KIBANA-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...
CVE-2026-82621 Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization
A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can...
EUVD-2026-68361
A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can...
CVE-2026-82621 Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization
A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can...
CVE-2026-82621
An authorization bypass vulnerability exists in Soarkey StudentManagement (学生信息管理系统), affecting versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e. The flaw resides in the AdminDao.doGet function of the Administrative Servlet (file code/src/service/AdminDao.java). An attacker can mani...
BIT-ELK-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...