CVE-2026-80347

mcp-fetch (npm package @kazuph/mcp-fetch ) through version 1.6.3 contains a Server-Side Request Forgery (SSRF) flaw in its isSafeUrl guard. When a target URL uses an IPv6 literal such as http://[::1]/, the parsed hostname retains the surrounding brackets. The net.isIP check returns zero for the b...

CVE-2022-0778

CVE-2022-0778 Descrizione Facciamo riferimento al concetto di drago-96 e poi riscriviamo un PoC basato sui formati P12 e PEM. Puoi usarlo per verificare le vulnerabilità CVE-2022-0778, ovvero un certificato SSL pericoloso senza alcuna password privata, lascialo vuoto. Se il dispositivo è affetto,...

PoC_CurveBall

CVE-2020-0601 - CurveBall Destaques PoC para CVE-2020-0601 Solução trivial para chave privada igual a 1 Solução não trivial para 1 chave-privada ordem-da-curva Escrito em C, usa a libcrypto do OpenSSL Requisitos Linux de alguma variedade apt install libssl libssl-dev Ou qualquer gerenciador de...

CVE-2020-13277

CVE-2020-13277 Lab CVE-2020-13277: Vulnerabilidade lógica do Gitlab - Acesso não autorizado de qualquer usuário a repositórios privados 0x10 Ambiente do Lab 0x20 Estrutura de diretórios root@kitploit: CVE-2020-13277 ├── README.md ............... 此 README 说明 ├── imgs .................... 辅助 README...

mallory

mallory HTTP/HTTPS proxy over SSH. Installation Local machine: go install github.com/justmao945/mallory/cmd/mallory@latest Remote server: need our old friend sshd Configuration Config file Default path is $HOME/.config/mallory.json, can be set when start program root@kitploit: mallory -config...

nccfsas

Introduction This repository holds information released publicly by NCC Group's Full Spectrum Attack Simulation FSAS team...

CVE-2026-79717 Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

A server-side request forgery SSRF vulnerability was found in galaxyng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata...

CovenantDecryptor

CovenantDecryptor CovenantDecryptor dient dazu, die Kommunikationsdaten des Covenant-Datenverkehrs zu entschlüsseln. Die Extraktion des privaten Schlüssels aus dem Speicher ist auch auf andere C2 anwendbar, wie z. B. Empire, da dort RSACryptoServiceProvider zur Erstellung des Schlüssels verwendet...

CVE-2026-0101-BLE-Address-Spoofing-via-Weak-Resolvable-Private-Address

CVE-2026-0101 – Spoofing dell'indirizzo BLE tramite indirizzo privato risolvibile debole Codice del programma simulazione Python con bleak root@kitploit: bleperipheralsim.py - Simulated BLE peripheral with weak RPA verification import asyncio, random, hashlib from bleak import BleakServer,...

driftwood

Driftwood ⚠️ The Driftwood CLI tool is no longer supported. Please use TruffleHog instead! ⚠️ Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user. Driftwood performs lookups with the computed public key, so the...

sshtunnel

|CircleCI| |AppVeyor| |readthedocs| |coveralls| |version| |pyversions| |license| Author : Pahaz Repo : https://github.com/pahaz/sshtunnel/ Inspired by https://github.com/jmagnusson/bgtunnel, which doesn't work on Windows. See also: https://github.com/paramiko/paramiko/blob/master/demos/forward.py...

roca

ROCA detection tool This tool is related to ACM CCS 2017 conference paper 124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. It enables you to test public RSA keys for a presence of the described vulnerability. Update 4.11.2017 : Python 2.7, 3.4+ supported...

CVE-2026-66766

SAP S/4HANA (Private Cloud) is affected by a Regular Expression Denial of Service (ReDoS) vulnerability in a third-party component within the Manage Supply Protection functionality. An unauthenticated attacker can supply specially crafted input that triggers excessive regex processing, exhausting...

JetBrains TeamCity < 2021.2.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. CVE-2022-24330 - In JetBrains TeamCity before 2021.2.1, the Agent...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Template Nuclei: CVE-2022-1598.yaml...

CVE-2026-75554

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...

CVE-2026-75542

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

cicd-goat

Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents...

about-hmac

Informazioni su HMAC Un esempio di implementazione di base di HMAC Hash-based Message Authentication Code utilizzando Flask in Python. Cos'è HMAC?! Il codice di autenticazione dei messaggi basato su hash HMAC fornisce al server e al client ciascuno una chiave privata nota solo a quel server e a...

CVE-2026-75554

CVE-2026-75554 is an Insufficient Session Expiration vulnerability in the OAuth token refresh grant of hex.pm (the Hackage Package Manager). The root cause lies in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal repositories scope. Explicitly granted repos...