The vulnerability of the btf_type_is_fwd() function in the kernel/bpf/btf.c module, which supports the BPF interpreter for Linux kernels, allows a attacker to cause a service failure.

The vulnerability of the btftypeisfwd function in the kernel/bpf/btf.c module, which supports BPF interpreter for Linux kernel, is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to cause a system failure...

PT-2026-85075

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms locoy news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...

PT-2026-84984

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function sess nowait of the file s71.py of the component Session Management. This manipulation of the argument session id causes authorization bypass. The attack can be initiated remotely. The vendor was...

The vulnerability of the mpc52xx_spiRemove() function in the driver/spi/spi-mpc52xx.c file of the Linux operating system’s SPI device driver allows a attacker to cause a service failure.

The vulnerability of the mpc52xxspiRemove function in the driver/spi/spi-mpc52xx.c file of the Linux kernel’s SPI device driver is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the checkCond_jmp_op() function in the kernel/bpf/verifier.c module, which is part of the BPF interpreter support in the Linux operating system’s kernel, allows a hacker to trigger a service failure.

The vulnerability of the checkCondjmpop function in the kernel/bpf/verifier.c module, which is part of the BPF interpreter support for Linux operating systems, is related to incorrect comparisons. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105436)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105436 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: Fix return type of netcpndostartxmit With clang's kernel control flow integrit...

The vulnerability of the pin_assignment_show() function in the drivers/usb/typec/altmodes/displayport.c file of the Linux operating system’s USB TypeC driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the pinassignmentshow function in the drivers/usb/typec/altmodes/displayport.c file of the Linux operating system’s USB TypeC driver is related to the re-liberation of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

Linux Distros Unpatched Vulnerability : CVE-2026-84165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an...

PT-2026-84980

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...

PT-2026-85037

Helicone's VaultManager.getDecryptedProviderKeyById function in the GET /v1/vault/key/providerKeyId endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream...

PT-2026-85235

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description A type confusion issue exists in the V8 JavaScript and WebAssembly engine. This flaw occurs when the V8 optimizer incorrectly validates the element type of an array during a sorting...

The vulnerability of the tcf_ct_skb_nfct_cached() function in the net/sched/act_ct.c module of the network scheduling subsystem of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the tcfctskbnfctcached function in the net/sched/actct.c module of the net/sched subsystem of the Linux operating system’s kernel is related to insufficient protection of service data. Exploiting this vulnerability could allow an attacker to cause a service failure...

Bludit CMS 3.20.0 Cross Site Scripting

Bludit CMS version 3.20.0 suffers from a cross site scripting vulnerability in the search plugin. Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting Date: 2026-08-11 Exploit Author: Ranjit Kumar Singh Vendor Homepage: https://www.bludit.com/ Software Link:...

...[ More ]

This Metasploit module exploits an unauthenticated command execution vulnerability in MCPJam Inspector. The /api/mcp/connect endpoint accepts a JSON serverConfig object containing a command and argument list used to start an MCP server. A remote attacker can abuse this endpoint to execute arbitra...

The vulnerability of the bpf_core_parse_spec() function in the tools/lib/bpf/relo_core.c file of the Linux operating system’s kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the bpfcoreparsespec function in the tools/lib/bpf/relocore.c file of the Linux operating system’s kernel is related to the execution of operations outside of the buffer memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...

CVE-2025-69604

CVE-2025-69604 Descripción Esta vulnerabilidad es similar a la descrita en CVE-2025-61229 – un atacante puede editar la plantilla de tareas para que las tareas de copia de seguridad de SuperDuper instalen un paquete arbitrario. El paquete puede entonces ejecutar scripts de shell como usuario root...

CVE-2025-9967

漏洞利用：未经身份验证的OTP密码重置 浏览器控制台PoC（无需认证） root@kitploit: async = async function getNonceAndAjaxUrl if window.resetpassobj return nonce: resetpassobj.ajaxnonce, ajaxUrl: resetpassobj.ajaxurl ; const home = await fetch'http://localhost/wordpress/'.thenr = r.text; const m =...

CVE-2025-9172

漏洞利用：通过 /vibes/v1/beacon 的基于时间的 SQL 注入（未认证） 浏览器控制台 PoC root@kitploit: async = const url = 'http://localhost/wordpress/index.php?restroute=/vibes/v1/beacon'; async function sendresource const body = type: 'navigation', resource, // injected into SQL unprepared authenticated: 0, metrics: name:...

CVE-2025-12137

1 使用当前 nonce 调用插件 REST API 的辅助函数 root@kitploit: async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path, method, headers:...

CVE-2025-49132-PoC

CVE-2025-49132-PoC CVE-2025-49132 的概念验证，针对 Pterodactyl Panel -m check Do something funny python3 poc.py -u -m exploit -p -t 技术细节 分析 v1.11.10 和 v1.11.11 之间 LocaleController.php 的 git diff（链接），可以看到控制器接受 locale 和 namespace 参数，没有任何验证或清理。 为了理解这为什么危险，我们将查看 panel/routes/base.php...