RLSA-2026:64808 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: can: bcm: add locking for bcmop runtime updates CVE-2025-38004 kernel: iouring/poll: fix signed comparison in iopollgetownership CVE-2026-52933 kernel: netfilter: nat: use kfreercu to...

CVE-2024-0044-EXP

CVE-2024-0044-EXP 利用 CVE-2024-0044 Android 权限提升下载任意目标App沙箱文件。 用法 root@kitploit: ./CVE-2024-0044.sh 参数 root@kitploit: 任意一个本地 APK 文件的路径 目标应用包名 示例 root@kitploit: ./CVE-2024-0044.sh /path/to/target.apk com.target.mobile 说明 1. 适用目标设备为Android12/13，设备要开启开发者模式，并且已经通过ADB 连接。 2. 下载任意的APK，你可以使用：F-DROID。 3...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - 已验证（作者以上权限）通过目录遍历实现任意文件读取 描述 WordPress 的 Comments Import & Export 插件在评论导入过程中，因文件路径验证不足，导致存在任意文件读取漏洞，影响版本至 2.3.7（含）。这使得经过身份验证的攻击者（拥有作者及以上权限）能够读取任意文件内容 Info root@kitploit: Type: plugin CVSS Score: 6.5 CVE: CVE-2024-7514 Link:...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - 对 AJAX 调用的不当访问控制（Subscriber+） 描述： 该插件中的部分 AJAX 调用未正确检查权限和 CSRF 令牌，从而导致任意文章读取、订阅者列表导出以及插件停用等问题。 root@kitploit: reference: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ef067b-e4b4-4174-b6ff-ec94a7afd55d?source=api-prod...

westone-CVE-2020-17519-scanner

westone-CVE-2020-17519-scanner Apache Flink 1.11.0、1.11.1、1.11.2 Hackers can read/write remote files via REST API Installation & Usage git clone https://github.com/Osyanina/westone-CVE-2020-17519-scanner.git cd westone-CVE-2020-17519-scanner cmd CVE-2020-17519.exe...

westone-CVE-2021-21980-scanner

westone-CVE-2021-21980-scanner Las versiones anteriores de VMware vCenter 7.0.2.00100 tienen una vulnerabilidad de lectura de archivos arbitrarios no autorizada + SSRF + XSS Instalación y Uso git clone https://github.com/Osyanina/westone-CVE-2021-21980-scanner.git cd westone-CVE-2021-21980-scanne...

CVE-2023-2825

CVE-2023-2825 - GitLab CE/EE 16.0.0 通过路径遍历导致任意文件读取 2023年5月23日，GitLab 发布了 16.0.1 版本，修复了一个影响社区版 CE 和企业版 EE 16.0.0 的关键漏洞 CVE-2023-2825。该漏洞允许未经身份验证的用户通过路径遍历缺陷读取任意文件。该漏洞由 pwnie 通过 HackerOne 的漏洞赏金计划发现。 在撰写本文时，尚无公开的概念验证可用。 GitLab 公告 未经身份验证的恶意用户可以利用路径遍历漏洞，在至少嵌套在五个组内的公共项目中存在附件时，读取服务器上的任意文件。这是一个严重级别的问题...

Docassemble_poc

Docassemblepoc Docassemble任意文件读取漏洞CVE-2024-27292 python Docassemblepoc.py -h root@kitploit: -. -. OO . OO . /. -. ,-.-'/. -. ,-.-' \ .' / | |OO\ .' / | |OO \ /\ | | \ \ /\ | | \ \ \ | | |/ \ \ | | |/ .' ,| |.' .' ,| |.' / .'. | | / .'. | | '--' '--' --' '--' '--' --' usage: Docassemblepoc.py...

CVE-2019-17662

CVE-2019-17662 CVE-2019-17662 TinyVNC 任意文件读取导致认证绕过漏洞的 Python 实现 基于 Nikhith Tumamlapalli 的原始 EDB PoC（EDB ID: 47519） 原始 PoC 利用由于 Python Requests 库中的路径规范化而无法工作。本仓库中的代码修复并改进了原始利用。 利用工具大部分自动化。查看 ./CVE-2019-17662.py --help 获取完整的开关选项。 警告： 本仓库中的代码仅可用于学术/道德目的。作者不赞同将此利用用于任何其他目的——它只能用于你拥有或已获授权测试的系统。...

EUVD-2026-74844

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...

CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...

CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...

CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

CVE-2026-87808

SiYuan versions prior to v3.8.2 contain an incomplete fix for CVE-2026-32767. The POST /api/search/fullTextSearchBlock endpoint, when invoked with method=2, forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a resu...

CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

qt: Qt: Denial of Service via out-of-bounds read in text codec handling

A flaw was found in Qt, a popular software development framework. This vulnerability, an out-of-bounds read, occurs in the QTextCodec::codecForName function when it processes specially crafted input that is not properly terminated. An attacker could exploit this to cause the application to select...

Important: Red Hat Security Advisory: qt5-qtbase security update

An update for qt5-qtbase is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer

A flaw was found in PostGIS. This out-of-bounds read vulnerability allows a remote attacker to cause memory disclosure or a server crash. This occurs when a malformed FlatGeobuf buffer is supplied, as the FlatGeobuf property metadata decoder fails to verify that the string body is contained withi...

glpi-logbleed

glpi-logbleed Inyección SQL ciega en el filtro del historial de registros de GLPI. CVE-2026-53629, corregida en 11.0.8 y 10.0.26, vulnerable desde 9.4.0. Requiere cualquier cuenta con el permiso de lectura logs. El perfil estándar de solo lectura lo tiene. Aviso: GHSA-cpcj-x335-5cmh Análisis: cóm...

CVE-2019-19204

CVE-2019-19204 在Oniguruma 6.x 6.9.4rc2之前版本中发现一个问题。在regparse.c的fetchintervalquantifier函数（原名fetchrangequantifier）中，调用PFETCH时未检查PEND。这导致基于堆的缓冲区越界读取。 研究人员：ManhND（来自Tarantula团队，VinCSS（Vingroup成员）） 什么是Oniguruma Oniguruma由K...