CVE-2026-80760 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

fabric-spark-custom-wheel-poc

Microsoft Fabric Spark custom-wheel POC !CIhttps://github...

ScubaGear

ScubaGear 是一款评估工具，用于验证 Microsoft 365 M365 租户的配置是否符合安全云商业应用（SCuBA）安全配置基线文档中描述的策略。 !NOTE 本文档可通过 GitHub Pages 阅读。 目标受众 ScubaGear 适用于希望根据 CISA 安全配置基线评估其租户环境的 M365 管理员。 概述 ScubaGear 使用三步流程： 第一步 - PowerShell 代码查询 M365 API 以获取各种配置设置。 第二步 - 随后调用 Open Policy Agent OPA，将这些设置与根据基线文档编写的 Rego 安全策略进行比较。 第三步 -...

Orbit Tracer

Orbit Tracer Orbit Tracer 安全代理，实现智能安全修复 利用 AI 和 Orbit 的知识图谱，自动化整个代码库的安全漏洞分析、风险评估与修复 问题 安全团队面临一个严峻挑战：发现漏洞很快，修复却耗时漫长。 root@kitploit: 手动漏洞修复流程： 1. SAST 扫描发现漏洞 5 分钟 2. 安全工程师分析影响 2 小时 3. 开发者创建修复 1 小时 4. 代码审查与批准 30 分钟 5. 合并与部署 30 分钟 总计：每个漏洞 4 小时以上 面对成百上千的发现结果和多个代码库，团队深陷手工操作，安全风险不断累积。 解决方案 Orbit Tracer...

metasploitable-pentest-lab

Metasploitable 中的漏洞利用 在受控且隔离的环境中完成一次真实攻击的完整流程：实验室准备、nmap 侦察、攻击面优先级排序、CVE 映射、Metasploit 漏洞利用、后渗透、凭据提取与破解，以及通过 SSH 密钥注入实现持久化。 1. 环境准备 攻击方 ：Kali Linux——msfconsole、nmap、John the Ripper。 目标 ：Metasploitable 1——Ubuntu 8.04（2010 年），未打补丁，存在多个已知 CVE。 网络 ：host-only，两台 VM 与任何真实网络隔离（192.168.64.0/24）。受害机...

PwnKit-CVE-2021-4034

PwnKit CVE-2021-4034 の PoC - Pkexec ローカル権限昇格 エクスプロイト 手動 root@kitploit: curl -fsSL https://raw.githubusercontent.com/jayhutajulu1/PwnKit-CVE-2021-4034/main/PwnKit -o PwnKit chmod +x ./PwnKit ./PwnKit interactive shell ./PwnKit 'id' single command パッチ適用済み パッチ適用済みのバージョンに対してエクスプロイトを実行すると、以下の出力が得られます。...

SafeLine v9.4.1

SafeLine - Make your web apps secure 🏠 Website | 📖 Docs | 🔍 Live Demo | 🙋‍♂️ Discord | 中文版 👋 INTRODUCTION SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP...

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the...

CVE-2025-64512

CVE-2025-64512 – pdfminer.six 反序列化 PoC 概述 此概念验证演示了 pdfminer.six （CVE-2025-64512）中的一个漏洞，在处理恶意 PDF 时可能导致任意命令执行。该漏洞利用程序使用一个构造的 PDF，引用恶意的 gzip 压缩 Python pickle 文件。当存在漏洞的应用程序解析该 PDF 时，它会加载 pickle 并执行其中嵌入的有效载荷。 包含的 PoC 被配置为执行 Python 反向 Shell，但有效载荷可以替换为任意命令。 要求 Python 3 requests 安装所需依赖： root@kitploit: p...

CVE-2019-13288

Xpdf version 4.02 2019-sep-25 The Xpdf software and documentation are copyright 1996-2019 Glyph & Cog, LLC. Email: [email protected] WWW: http://www.xpdfreader.com/ The PDF data structures, operators, and specification are documented in ISO 32000-2:2017. What is Xpdf? Xpdf is an open source...

CVE-2026-85696

SadTalker (OpenTalker), a talking-head video generation tool, contains an OS command injection vulnerability in its video muxing process . In version v0.0.2 , uploaded audio filenames are interpolated into ffmpeg commands without proper escaping (see src/utils/videoio.py). An attacker can upload ...

EUVD-2026-71145

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

EUVD-2026-71130

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85674

aider (aider-chat) is a CLI-based AI coding assistant that automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), both of which are e...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85672 zerox 1.1.20 OS Command Injection via Document URL File Extension

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

EUVD-2026-71128

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...