CVE-2023-5044

CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation Firstly, you need deploy Pod & Service: root@kitploit: kind: Pod apiVersion: v1 metadata: name: apple-app labels: app: apple spec: containers: - name: apple-app image: hashicorp/http-echo args: -...

kalici-dosya-silme-araci

Permanent File Deletion Tool & Kalıcı Dosya Silme Aracı This project is a simple tool that allows users to permanently delete specified files. The program overwrites the specified file with random data, changes the content of the file, and then deletes it, effectively removing any traces of the...

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

CVE-2026-86748

Snipe-IT versions before 8.7.0 contain a vulnerability in the restore endpoint where the database is wiped before the uploaded backup archive is validated. A superuser uploading a corrupted or invalid zip file triggers permanent data loss with no recovery path or rollback mechanism. The CVSS 3.1 ...

CVE-2026-28584

In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73948

In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-77121

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only t...

EUVD-2026-70232

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only t...

CVE-2026-47863

Reactor Core versions 3.8.0–3.8.6 and 3.7.19 and earlier are vulnerable to a Denial of Service condition in the Flux.bufferTimeout operator when fairBackpressure is enabled. The root cause is a race condition between flushing buffered items and the arrival of new upstream items during an active f...

CVE-2026-47863 Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: enetc: The illegal access issue when reading the affinityhint parameter has been fixed. The irqsetaffinityhit function stores a reference to the cpumaskt parameter in the irqdescriptor. This reference can be accessed later from...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: spi: qup: Do not skip cleanup in the error path of the remove function. Returning early in the remove callback of a platform driver is incorrect. In this case, the DMA resources are not released during the error path. This issue ...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: rndishost: The secure rdrisquery check prevents integer overflow. The variables off and len, which are typed as uint32 in the rdrisquery function, are controlled by the incoming RNDIS response message. Therefore, their value...

cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush...

CVE-2026-14886

Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability CVE-2026-14886 is fixed...

PT-2026-69914

Name of the Vulnerable Software and Affected Versions Vault Enterprise versions prior to 2.0.4 Vault Enterprise versions prior to 1.21.9 Vault Enterprise versions prior to 1.20.14 Vault Enterprise versions prior to 1.19.20 Description The identity entity batch-delete endpoint is subject to a...

CVE-2026-67585

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

CVE-2026-19127 Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

CVE-2026-19127

CVE-2026-19127 affects the billing and license activation subsystem of the Postiz app. The issue arises from insufficient cryptographic validation or lack of server-side state verification for promotional/lifetime-deal (LTD) redemption codes, enabling an unauthenticated attacker to forge valid re...

CVE-2026-19127 Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...