Rocky Linux 9 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource (crlsa-2024_1502)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241502 advisory. grafana-pcp: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 This advisory is provided by Ctrl IQ, Inc for Rocky Linu...

Rocky Linux 8 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource (crlsa-2024_1644)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241644 advisory. golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 Bug Fixes: TRIAGE CVE-2024-1394 grafana-pcp: golang-fips/openssl:...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2026_54184)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654184 advisory. grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-42127 Tenable has extracted the preceding description block...

Memetic Trojans: Social Contagions As Carriers of Adversarial Payloads in Agent Networks

Autonomous large language model LLM agents increasingly interact in network environments where adversarial content can propagate between agents. Known attacks include agent worms, which spread through self-replicating prompt injections or configuration compromises. We introduce memetic trojans, a...

AlmaLinux 8 : grafana (ALSA-2026:54243)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54243 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana: Denial of Service due to excessive memory allocation via...

react2shell-detector

Detector de React2Shell Una extensión de Chrome para detectar vulnerabilidades React2Shell CVE-2025-55182 y CVE-2025-66478 en aplicaciones web. Descripción general React2Shell Detector es una extensión de navegador que ayuda a investigadores de seguridad y desarrolladores web a identificar posibl...

CVE-2026-50522

CVE-2026-50522 Microsoft SharePoint CVE-2026-50522 cargas útiles y análisis. Peticiones HTTP request| src| user-agent| encoding| unique id| payload ---|---|---|---|---|--- 816978882| 45.63.58.216| Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36| '|...

CVE-2021-44228-Log4j-Payloads

Este repositorio no tiene un README...

Root-My-Galaxy

Root My Galaxy Root My Galaxy es un instalador de un solo clic para combinaciones de modelo y kernel de Samsung explícitamente compatibles. La aplicación en sí se mantiene separada de los offsets de dispositivo, los payloads nativos de explotación y los artefactos de compilación de KernelSU. Últi...

mjet

mjet Mogwai Security Java Management Extensions JMX Exploitation Toolkit mjet es una herramienta que puede utilizarse para proteger servicios JMX configurados de forma insegura. Se basa en el artículo "Exploiting JMX-RMI" de Braden Thomas/Accuvant "http://www.accuvant.com/blog/exploiting-jmx-rmi"...

JavaPayload

JavaPayload JavaPayload es una colección de payloads Java puros para usar en la post-explotación desde exploits Java puros o desde configuraciones incorrectas comunes como el administrador de Tomcat sin protección por contraseña o el puerto del depurador. La documentación desactualizada se puede...

CVE-2025-55182POC

CVE-2025-55182 POC de RCE en React Server Components Este proyecto es una Prueba de Concepto PoC para CVE-2025-55182 - Ejecución Remota de Código RCE en React Server Components RSC , que demuestra cómo, bajo ciertas condiciones, se puede desencadenar ejecución remota de código mediante...

CVE-2025-24813-PoC

CVE-2025-24813-PoC CVE-2025-24813 afecta a Apache Tomcat - si es una versión vulnerable y está espectacularmente mal configurado, un atacante puede obtener RCE con un GET y un POST. Más información aquí Este es el script de Yiheng An, Jun Li, Qiang Liu, Haozhe Zhang, Qi Deng del reciente informe...

ActBench

ActBench ActBench is a self-evolving benchmark of behavioral safety in cowork agents. It defines behavioral safety as whether an agent's execution remains within the permissions and state changes required by a benign task, and evaluates realized behavioral risk from execution trajectories rather...

CVE-2026-100868

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868

Versions of Penpot prior to 2.18.0 are vulnerable to unauthenticated access via the MCP server plugin WebSocket bridge . In single-user mode, the bridge binds to all network interfaces without authentication, allowing unauthenticated attackers on adjacent networks to connect to the WebSocket port...

EUVD-2026-87940

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2025-55182-Scanner

CVE‑2025‑55182 – Escáner de RCE por Deserialización RSC en Next.js Esta herramienta verifica si un objetivo es vulnerable a CVE‑2025‑55182 , un fallo de Ejecución Remota de Código causado por el manejo inseguro de cargas útiles de modelo RSC React Server Components dentro de Next.js. La...

Log4J-Scanner

Extensión de Burp para escanear la vulnerabilidad Log4Shell CVE-2021-44228 con payloads personalizados. Descargo de responsabilidad No soy responsable de tus acciones, de que Burp Suite se congele, de que el objetivo sea hackeado, de una guerra termonuclear, o de la crisis económica actual causad...

CVE-2026-100868: Binding to an Unrestricted IP Address

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...