CVE-2026-86818

A flaw was found in fast-uri, a Node.js URI parser. In versions 4.1.3 and 4.1.4, the mailto parser incorrectly handles percent-encoded query field names. This desynchronization between parsing and serialization allows an attacker to inject arbitrary recipients, subjects, or body content into mail...

adlc

ADLC Bug-Fix PoC A proof of concept for an agentic developm...

CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-91840

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when th...

Root-My-Device

Root My Device A fork of BuSung-dev/Root-My-Galaxy, under the Apache License 2.0 — see LICENSE and Credits. Root My Device is a one-click installer for explicitly supported firmware builds. The application itself is kept separate from device offsets, native exploit payloads, and KernelSU build...

deepdarkCTI

deepdarkCTI Collection of Cyber Threat Intelligence sources from the Deep and Dark Web The official website of the project is https://www.deepdarkcti.com. The aim of this project is to collect the sources, present in the Deep and Dark web, which can be useful in Cyber Threat Intelligence contexts...

cpanel-sessionscribe

SessionScribe - CVE-2026-41940 Critical unauthenticated RCE in cPanel & WHM. Four HTTP requests forge a root session via CRLF injection into the password field of a preauth session. No auth, no preconditions, every supported tier affected. Disclosed 2026-04-28 by Sina Kheirkhah / watchTowr Labs...

Zircolite

Standalone SIGMA-Based Detection Tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, or JSONL/NDJSON Logs Zircolite is a standalone tool written in Python 3 that allows you to use SIGMA rules on: MS Windows EVTX EVTX, XML, and JSONL formats Auditd logs Sysmon for Linux EVTXtract CSV and XML logs...

EvilSelenium

EvilSelenium EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are: Steal stored credentials via autofill Steal cookies Take screenshots of websites Dump Gmail/O365 emails Dump WhatsApp messages Download & exfiltrate files Add...

maigret

Maigret English · 简体中文 Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors IPcook provides reliable residential proxies for online...

Aura-State

Aura-State A Python framework for building LLM workflows as state machines, with formal verification built in. root@kitploit: pip install git+https://github.com/munshi007/Aura-State.git What this is Most LLM frameworks let you chain API calls and hope for the best. Aura-State takes a different...

Politician

Politician A sophisticated WiFi auditing library for ESP32 microcontrollers Politician is an embedded C++ library designed for WiFi security auditing on ESP32 platforms. It provides a clean, modern API for capturing WPA/WPA2/WPA3 handshakes and harvesting enterprise credentials using advanced...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Environment Setup Use the following commands to build and run the vulnerable Langflow environment: root@kitploit: docker build -t...

CVE-2022-28598

ERPNext - 12.29.0 Stored cross-site scripting XSS vulnerability in the "lastknownversion" field found in the "My Setting" page in ERPNext 12.29.0 allows remote attackers to inject arbitrary web script or HTML via a crafted site name by doing an authenticated POST HTTP request to...

Preparation-Guide-to-OSCP

Guide to OSCP I am writing this guide to cover all OSCP topics as well as other infosec knowledge in details, I will also provide a cheat-sheet in each section so that you can use the commands directly once you understand the topics/tools. But I think to become a good pentester you should know ho...

sparrow-wifi

Sparrow-WiFi Sparrow-WiFi is a 2.4 GHz and 5 GHz WiFi and Bluetooth spectral awareness tool for Linux. It integrates WiFi scanning, Bluetooth Low Energy and Classic discovery, software-defined radio spectrum analysis HackRF, Ubertooth, GPS tracking, FAA RemoteID drone detection, drone/rover-mount...

wrongsecrets

OWASP WrongSecrets Welcome to the OWASP WrongSecrets game! The game is packed with real life examples of how to not store secrets in your software. Each of these examples is captured in a challenge, which you need to solve using various tools and techniques. Solving these challenges will help you...

neo

Neo Turn any web app into an API. No official API needed. No browser automation. Neo is a Chrome extension that passively captures every API call your browser makes, learns the patterns, and lets AI or you replay them directly. The Problem AI agents operating web apps today have two options, both...

EUVD-2026-78403

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...