OESA-2026-3760 openjdk-21 security update

The OpenJDK runtime environment. Security Fixes: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer ASan, the program leaks memory in various locations, eventually leading to high memory usage and causi...

OESA-2026-3759 openjdk-21 security update

The OpenJDK runtime environment. Security Fixes: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer ASan, the program leaks memory in various locations, eventually leading to high memory usage and causi...

OESA-2026-3721 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options...

OESA-2026-3707 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: seg6: separate dstcache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dstcache per encap route, shared between seg6inputcore and...

wp2shell

wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

-CVE-2017-0785-BlueBorne-PoC

-CVE-2017-0785-BlueBorne-PoC CVE-2017-0785 BlueBorne PoC Resumen General Armis Labs reveló un nuevo vector de ataque que pone en peligro los principales sistemas operativos móviles, de escritorio y IoT, incluidos Android, iOS, Windows y Linux, y los dispositivos que los utilizan. El nuevo vector ...

ansible-CVE-2024-3094

ansible-CVE-2024-3094 Ansible playbooks designed to check and remediate CVE-2024-3094 XZ Backdoor. These were developed with guidance from https://jfrog.com/blog/xz-backdoor-attack-cve-2024-3094-all-you-need-to-know/. Background Running the checks to see if your Linux system is vulnerable is simp...

Livepyre

Livepyre A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APPKEY of the Livewire project is known. Authors of the tool: @remsio @Worty. Help root@kitploit: $ ./Livepyre.py -h usage: Livepyre.py -h -u URL -f FUNCTION -p PARAM -H HEADERS -P PROXY -a APPKEY -d -F -c...

CVE-2024-25153

CVE-2024-25153 This is a proof of concept for CVE-2024-25153, a Remote Code Execution vulnerability in Fortra FileCatalyst Workflow 5.x, before 5.1.6 Build 114. Full technical details can be found at https://labs.nettitude.com/blog/cve-2024-25153-remote-code-execution-in-fortra-filecatalyst Usage...

cve-2025-32433

Construcción root@kitploit: » git clone https://github.com/0xPThree/cve-2025-32433.git && cd cve-2025-32433 » docker build -t erlang-ssh . » docker run -d --name erlang-ssh -p 2222:2222 erlang-ssh POC root@kitploit: kdev :: /erlang/CVE-2025-32433 ‹main› » python3 cve-2025-32433.py -h usage:...

MGASA-2026-0406 Updated zip packages fix a security vulnerability

zip test option -T command injection. Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash or possibly have unspecified other impact because of an off-by-one error. CVE-2018-13410...

Updated zip packages fix a security vulnerability

zip test option -T command injection. Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash or possibly have unspecified other impact because of an off-by-one error. CVE-2018-13410...

CVE-2022-29593

CVE-2022-29593 - Bypass de autenticación mediante captura-reproducción Dingtian-DT-R002 Title Bypass de autenticación mediante captura-reproducción Publicado: Version: 1.0 Vendor: Shenzhen Dingtian Technologies Co.,Ltd Producto: Placa de relé de 2 canales/Tarjeta de relé Versión afectada: Firmwar...

omigood

omigood OM I GOOD? This repository contains a free scanner to detect VMs vulnerable to one of the "OMIGOD" vulnerabilities discovered by Wiz's threat research team, specifically CVE-2021-38647. Original blog post from Wiz: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure...

CVE-2026-57124

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CiscoRV320Dump

CiscoRV320Dump Exploits CVE-2019-1653/CVE-2019-1652 para volcar configuraciones de Cisco RV320 y obtener RCE Implementaciones de los exploits CVE-2019-1652 y CVE-2019-1653 divulgados por Red Team Pentesting GmbH. Solo probé estos en un RV320, pero según el aviso de Cisco, el RV325 también es...

CVE-2024-1086

CVE-2024-1086 Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images...

CVE-2025-55182-advanced-scanner-

CVE-2025-55182 Scanner Simple command-line tool for detecting and exploiting CVE-2025-55182 React Server Components RCE in Next.js applications. Installation root@kitploit: chmod +x scanner.sh Usage root@kitploit: Scan with default command id ./scanner.sh -d example.com Execute custom command...

CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...