CVE-2026-75601

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

scorecard

OpenSSF Scorecard...

CVE-2026-55677 vulnerabilities

Vulnerabilities for packages: temporal-fips, temporal-ui-server-fips, kube-metrics-adapter-fips, falcosidekick-ui-fips, temporal-ui-server, temporal, listmonk, falcosidekick-ui, kube-metrics-adapter...

AIF360

German Credit Data Source / Data Set Description: https://archive.ics.uci.edu/ml/datasets/Statlog+%28German+Credit+Data%29 This dataset classifies people described by a set of attributes as good or bad credit risks. File used is german.data consisting of 1000 instances and 20 features. Detailed...

suricata_exporter

Suricata Prometheus Exporter Dies ist ein Prometheus-Exporter für Suricata, der dump-counters über den Unix-Socket verwendet, um Metriken abzufragen. Verwendung root@kitploit: $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket...

CVE-2024-32030-Nuclei-Template

Template Nuclei per CVE-2024-32030 Descrizione Questo repository contiene un template Nuclei per rilevare la vulnerabilità CVE-2024-32030. Tale vulnerabilità consente l'esecuzione remota di codice tramite risoluzione JNDI nella raccolta metriche JMX. Dettagli della vulnerabilità ID: CVE-2024-3203...

CVE-2026-79668

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

BIT-KEYCLOAK-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

EUVD-2026-65446

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

CVE-2019-10475

CVE-2019-10475 POC rapido per Jenkins CVE-2019-10475 / SECURITY-1490 segnalato il 2019-10-23. Il problema riguarda il plugin build-metrics che genera alcune metriche di build di base. È comunemente usato con il plugin dei collegamenti della barra laterale di Jenkins. Questa è una semplice e...

Milvus - Unauthenticated Metrics API Access

Milvus 2.5.27 and 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091. id: CVE-2026-26190 info: name: Milv...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Apache Solr - Host Environment Variables Leak via Metrics API

Exposure of Sensitive Information to an Unauthorized Actor Vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users can specify which environment variables to hide, however, the default list is designed to wor...

11in1 CMS 1.2.1 - Local File Inclusion (LFI)

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php. id: CVE-2012-0996 info: name: 11in1 CMS 1.2.1 - Local File Inclusion LFI author: daffainfo...

bug-bounty-reports-desai-vinayak

🧩 Report Bug Bounty — Desai Vinayak 🔒 Report di bug bounty e ricerca sulle vulnerabilità di Desai Vinayak. Questo repository raccoglie report passivi e non distruttivi su vulnerabilità e prove a supporto per divulgazione coordinata e tracciamento della risoluzione. 📁 Contenuti 📂 reports/ — PDF,...

popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

ayaFlow

ayaFlow ayaFlow ist ein Netzwerkverkehrsanalysator in Rust + eBPF, erstellt mit Aya. Es führt einen Agenten pro Linux-Knoten aus, bindet einen TC-Klassifikator am Eingang und Ausgang und stellt Live-Verkehrsdaten, historische, SQLite-gestützte Verläufe und Prometheus-Metriken zur Verfügung. Was e...

http-desync-guardian

Overview HTTP/1.1 went through a long evolution since 1991 to 2014: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 - 2014...

essh

root@kitploit: ███████╗███████╗███████╗██╗ ██╗ ██╔════╝██╔════╝██╔════╝██║ ██║ █████╗ ███████╗███████╗███████║ ██╔══╝ ╚════██║╚════██║██╔══██║ ███████╗███████║███████║██║ ██║ ╚══════╝╚══════╝╚══════╝╚═╝ ╚═╝ Enhanced SSH for people with fleets...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...