sleep_python_bridge

Cobalt Strike Sleep Python Bridge This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for the standard GUI client. NOTE: This project is very much in BETA. The goal is to provide a playground for testi...

Loki

🧙‍♂️ Loki Command & Control Loki is a stage-1 command and control C2 framework written in Node.js, built to script-jack vulnerable Electron apps MITRE ATT&CK T1218.015. Developed for red team operations, Loki enables evasion of security software and bypasses application controls by exploiting...

kurasagi

kurasagi kurasagi is full POC of PatchGuard bypass for Windows 24H2 - 25H2. For more information, please refer to the product branch, which contains the PDF paper detailing the bypass. If any BSOD which is related toCRITICALSTRUCTURECORRUPTION PatchGuard appears, please create issue with it!...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability 1. Vulnerability Description Zoho ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...

CVE-2021-21424

CVE-2021-21424 Directory Traversal and file exposure • CVE-2021-21424 • Description: WebProfiler exposes internal server paths if it is not disabled in production. • Affected versions: Symfony 2.8 to 5.x. • Typical bypass: direct access to /appdev.php/profiler/. root@kitploit: Summary of...

MasterHttpRelayVPN-RUST v1.9.37

mhrv-rs — bypass censorship for free, with your own Google account A small program that runs on your computer and lets you visit blocked websites for free, using a Google Apps Script you deploy in your own free Google account. Your ISP only sees encrypted traffic towww.google.com — it can't tell...

UniPwn

Unitree Robot BLE Service Command Injection Analysis Author: Bin4ry aka Andreas Makris [email protected] Co-Author: h0stile aka Kevin Finisterre Contributor: legion1581 aka Konstantin Severov from theroboverse helped to fix the payload for the injection and proved it with a fully working PoC...

thermoptic

thermoptic "I don't believe it, thermoptic camouflage!" What is it? This is an HTTP proxy designed to bypass services that use fingerprinting such as JA4+ to block certain HTTP clients. Using this proxy, you can use your preferred HTTP clients like curl and still have magically indistinguishable...

CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

CVE-2026-21013 – PDF JavaScript Injection via Embedded Script Program Code Python generating malicious PDF root@kitploit: generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f: f.writepdf...

CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing

CVE-2026-21009 – ECDSA Nonce Reuse in IoT Firmware Signing Program Code Python root@kitploit: ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware images with sam...

CVE-2026-0092

CVE-2026-0092 In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. NVD - CVE-2026-0092 Android...

c4-meta-system

C4-META System v1.0.0 research prototype Research prototype for multi-layer AI defense: C4 explainability, ensemble classifiers, deobfuscation, O₂ security engine, ThoughtVirus defense, and SVETILO value alignment. Alpha-grade — validated internally, external audit pending. Version: 1.0.0-alpha |...

Azure-APIM-Dev-Portal-Signup-Bypass

A proof-of-concept script for bypassing a disabled developer portal signup on Azure API Management APIM by directly invoking the backend registration API. What it does Azure APIM developer portals can be configured to disable self-service signup through the portal UI. In some deployments the...

CVE-2026-85381

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such...

codex-security npm-v0.1.25

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. 👉👉 See theCodex Security documentation for full documentation. Some cybersecurity requests and protected findings require approval through Trusted Access fo...

CVE-2026-85381

light0011 CMS is affected by an authorization bypass in the Chapter Controller component (file App/Home/Controller/ChapterController.class.php). The root cause is manipulation of the content argument, which an unauthenticated remote attacker can exploit to bypass access controls. The impact is a ...

EUVD-2026-70854

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such...

CVE-2026-85381 light0011 cms Chapter Controller ChapterController.class.php authorization

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such...

CVE-2026-85381 light0011 cms Chapter Controller ChapterController.class.php authorization

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such...

Important: Red Hat Security Advisory: buildah security update

An update for buildah is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...