UBUNTU-CVE-2026-80734

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation

Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. These endpoints allow remote clients to perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB...

rabl-old

RABL RABL Ruby API Builder Language is a Rails and Padrino ruby templating system for generating JSON, XML, MessagePack, PList and BSON. When using the ActiveRecord 'tojson' method, I find myself wanting a more expressive and powerful solution for generating APIs. This is especially true when the...

text4shell-policy

Text4Shell Demo This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line Option 1: Check if your remote OCI image is affected using cue with cosign 2.0 root@kitploit: cosign verify-attestation --policy...

VIKIROOT

VIKIROOT This is a CVE-2016-5195 PoC for 64-bit Android 6.0.1 Marshmallow perhaps 7.0 ?, as well as an universal & stable temporal root tool. It does not require a SUID executable or any filesystem changes. Features SELinux bypass see below for details. Memory-only: does not modify the filesystem...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

Log4Shell-Honeypot

Log4Shell Honeypot Enhanced dockerized honeypot for CVE-2021-44228 with comprehensive security features, monitoring, and alerting capabilities. Features Enhanced Detection Comprehensive Pattern Matching : Detects 20+ Log4Shell exploit patterns including JNDI, LDAP, RMI, DNS, and environment...

Log4jPatch

-- This repository has been archived -- Further development of this tool will continue at corretto/hotpatch-for-apache-log4j2. Thanks for sharing, commenting, trying it out and contributing to this project! Log4jPatch This is a POC of a simple tool which injects a Java agent into a running JVM...

CVE-2023-4911

CVE-2023-4911-Looney-Tunables Looney Tunables Local privilege escalation CVE-2023-4911 workshop for educational purposes only Links: IPPSEC video Qualsys Blog Post Qualsys Tech Details Exploit POC python script GLIBC sources GLIBC tunables documentation Description What is ld.so? In computing, a...

gitpython: GitPython: Arbitrary File Overwrite via improper git option validation

A flaw was found in GitPython. This vulnerability allows a remote attacker to overwrite arbitrary files on the system. By failing to properly validate git options passed to the Diffable.diff method, an attacker can supply a malicious output argument to write patch content to attacker-controlled...

GHSA-VPJW-WF5H-CGPQ SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

CVE: This vulnerability corresponds to CVE-2026-72804. Summary getGraph and getLocalGraph filter reader sessions against the visibility tier only and never check the publish password. Password-protected documents are Visible = true, so their graph nodes survive the filter and graph nodes are...

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

CVE: This vulnerability corresponds to CVE-2026-72804. Summary getGraph and getLocalGraph filter reader sessions against the visibility tier only and never check the publish password. Password-protected documents are Visible = true, so their graph nodes survive the filter and graph nodes are...

pocindex

Just landed Trending in 2026 Trending in 2025 2024, 2023, 2022 Trending in 2024 Data Every file is plain JSON on the CDN. No key, no rate limit. root@kitploit: everything the index knows about one CVE curl -s https://pocindex.io/CVElist.json \ | jq '. | select.cve == "CVE-2021-44228" | cve, poc:...

Security Bulletin: Multiple Vulnerabilities in Java affecting Rational Application Developer for Websphere Software

Summary There are multiple vulnerabilities in the Java SDK that is used by Rational Application Developer for Websphere Software. July Security Update. CVE-2026-47057, CVE-2026-47063, CVE-2026-60147, CVE-2026-47027, CVE-2026-47021, CVE-2026-16439, CVE-2026-16441, CVE-2026-16243 Vulnerability...

Rocket.Chat v8.8.0

The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...

CVE-2025-30374

CVE-2025-30374 Class Pollution Vulnerability in Taipy Leading to RCE, XSS, DoS, and Credential Leakage Summary A class pollution vulnerability has been identified in Taipy v4.0.3 the latest version at the time of discovery. This vulnerability allows unauthorized attackers to overwrite the Taipy...

qyvora-toha3ee

toha3ee A local & network security assessment framework written in Go. It is a research and authorised-penetration-testing tool that covers the network assessment pipeline — host and service discovery, enumeration, credential auditing, vulnerability identification and authorised exploitation. Its...

Specter-FlipperZero v2.8

Specter 👻 Sweep for the readers you can't see. -26E8CA?style=for-the-badge&labelColor=0a0f16 Specter turns your Flipper Zero into a pocket counter-surveillance...

Decoder-Improved

Decoder Improved tl;dr Within extender load Decoder-Improved.jar latest release For a walkthrough on how to extend Decoder Improved visit ourblog post. The link to the original description seems to be broken. While there's no up-to-date walkthrough about how to extend Decoder Improved at the...

cq

cq Code Query, a universal code security scanning tool. CQ scans code for security vulnerabilities and other items of interest to security-focussed code reviewers. It outputs text files containing references to issues found, into an output directory. These output files can then be reviewed,...