CVE-2026-84697 Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to...

EUVD-2026-69726

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

EUVD-2026-69713

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function listtools of the file tools/mcptool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The...

EUVD-2026-69700

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has...

CVE-2026-84427 zhayujie CowAgent Bash Tool bash.py denial of service

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed an...

CVE-2026-84427

CVE-2026-84427 affects zhayujie CowAgent versions up to 2.1.7 . The vulnerability resides in the Bash Tool component, specifically in the file agent/tools/bash/bash.py. The root-cause function is not precisely identified in the CVE description, though a linked GitHub report title references an ou...

EUVD-2026-69782

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed an...

CVE-2026-84427 zhayujie CowAgent Bash Tool bash.py denial of service

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed an...

CVE-2021-3156

CVE-2021-3156 xchg@ubuntu:/Desktop/CVE-2021-3156$ ./sudo-hax-me-a-sandwich CVE-2021-3156 PoC by blasty [email protected] usage: ./sudo-hax-me-a-sandwich available targets: root@kitploit: 0 Ubuntu 20.04.1 Focal Fossa - sudo 1.8.31, libc-2.31 1 Debian 10.0 Buster - sudo 1.8.27, libc-2.28...

EUVD-2026-69781

A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browsertool.py of the component Browser Tool. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made...

CVE-2026-84425 zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service

A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browsertool.py of the component Browser Tool. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made...

CVE-2026-84425

zhayujie CowAgent (versions up to 2.1.3) is vulnerable to a remote denial of service in the BrowserTool function within agent/tools/browser/browser_tool.py (the Browser Tool component). An attacker with low privileges can trigger the DoS remotely with low complexity and no user interaction. A pro...

CVE-2026-84425 zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service

A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browsertool.py of the component Browser Tool. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made...

inspector-gadget

inspector-gadget root@kitploit: Go Go Gadget Exploit! ..--"\ |""--.. .-' \ | '-. / |...----'\ |,,..--""--.. | '\ .--'.I. ''--..' ''",JGS/|,---' ,' .::-. ', ' ,'-;oIo;-', ' - | = | | | ; .. ; ..-;|\ - /|;-. -' / \// \ '- / ; /-'; \ ; .--| |O O |'-./ ; |/ \ ;OO/ | | \ II / | \ / |O O \ / / | ...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

PT-2026-84644

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode easywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

The vulnerability of the hvpciprobe() function in the drivers/pci/controller/pci-hyperv.c file of the Linux operating system’s PCI device driver module allows a hacker to cause a service failure.

The vulnerability of the hvpciprobe function in the drivers/pci/controller/pci-hyperv.c file of the Linux kernel’s PCI device driver module is related to the lack of lock checking. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the analyse_resultat_skel() function in the SPIP content management system allows a hacker to execute arbitrary code.

The vulnerability of the analyseresultatskel function in the SPIP content management system is related to improper handling of code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the MongoDB database management system, related to the lack of use of the assert() function, allows a attacker to trigger a service failure.

The vulnerability of the MongoDB database management system is related to the lack of use of the assert function. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the l2tp_xmit_core() function in the net/l2tp/l2tp_core.c module, which is part of the Linux operating system’s Layer 2 Tunneling Protocol core, allows a attacker to cause a service failure.

The vulnerability of the l2tpxmitcore function in the net/l2tp/l2tpcore.c module, which is part of the Linux L2TP protocol implementation, is related to incorrect input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...