Lucene search
+L

319567 matches found

Cvelist
Cvelist
added 2026/09/10 11:27 p.m.1 views

CVE-2026-77807 AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

7.5CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/10 11:27 p.m.5 views

CVE-2026-77807 AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

7.5CVSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/09/10 11:22 p.m.0 views

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

8.1CVSS0.00873EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 2026/09/10 11:22 p.m.1 views

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

6.5CVSS0.00309EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/09/10 11:22 p.m.1 views

org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

8.1CVSS0.0074EPSS
SaveExploits2References6
Kitploit
Kitploit
added 2026/09/10 10:46 p.m.7 views

test-your-sysadmin-skills

:star: "A great Admin doesn't need to know everything, but they should be able to come up with amazing solutions to impossible projects. " - cwheeler33 ServerFault :star: "My skills are making things work, not knowing a billion facts. ... If I need to fix a system I’ll identify the problem, check...

5.8AI score
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/09/10 10:39 p.m.0 views

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

SaveExploits0References2Affected Software1
Kitploit
Kitploit
added 2026/09/10 10:17 p.m.10 views

wolfssl

wolfSSL Embedded SSL/TLS Library The wolfSSL embedded SSL library formerly CyaSSL is a lightweight SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments - primarily because of its small size, speed, and feature set. It is commonly used in standar...

5.9AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/10 10:10 p.m.11 views

atlant-harden

AtlantHarden — Windows, Browser & Office Security Hardening Tool AtlantHarden is a comprehensive Windows 10/11 security hardening application with a modern, professional UI. It applies 606 hardening settings — including 354 DISA STIG controls across Windows 11, Edge, Chrome, Firefox, and Office 3...

6AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/10 9:59 p.m.7 views

Awesome-WAF

Awesome WAF Everything about web application firewalls WAFs from a security perspective. 🔥 Foreword: This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there.As the saying goes, "the community just learns from...

6.5AI score
SaveExploits0References16
Kitploit
Kitploit
added 2026/09/10 9:41 p.m.6 views

dns-rebind-toolkit

DNS Rebind Toolkit Demo | Security Advisory | Included Payloads | FAQ DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick. DNS Rebind Toolkit is a frontend JavaScript framewor...

6AI score
SaveExploits0References9
Github Security Blog
Github Security Blog
added 2026/09/10 9:23 p.m.0 views

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

6.8CVSS
SaveExploits0References6Affected Software1
NVD
NVD
added 2026/09/10 9:17 p.m.2 views

CVE-2026-89089

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

6.5CVSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 2026/09/10 9:16 p.m.0 views

n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch..remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so...

5.3CVSS0.00323EPSS
SaveExploits0References6Affected Software1
Kitploit
Kitploit
added 2026/09/10 9:08 p.m.8 views

osint-brazuca

OSINT Open-source intelligence Navigation : 🏠 Main README | 📖 Practical Examples | 🔀 Flowcharts | 📊 Quick Guide | 🤝 Contribute Introduction The OSINT Brazuca Project is a repository created with the aim of gathering information, sources websites/portals and OSINT tricks within the Brazilian conte...

6.3AI score
SaveExploits0References13
Kitploit
Kitploit
added 2026/09/10 9:02 p.m.17 views

mofos

mofos Concept Installation Configure the host QEMU/KVM system session Security considerations Mofos configuration Install a template Configure the firewall Install Import Create the upper layer empty disk Create a virtual machine Customization Template - hook install Virtual machine - hook new...

6.4AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/10 9:01 p.m.6 views

CVE-2021-24959

CVE-2021-24959 Descripción El plugin WP Email Users de WordPress hasta la versión 1.7.6 no escapa el parámetro dataraw en la acción AJAX weuselectedusers1, disponible para cualquier usuario autenticado, permitiéndoles realizar ataques de inyección SQL. root@kitploit: CVE CVE-2021-24959 CVSS 8.8...

8.8CVSS7.9AI score0.02249EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/10 8:55 p.m.6 views

P4wnP1_aloa

P4wnP1 A.L.O.A. P4wnP1 A.L.O.A. por MaMe82 es un framework que convierte una Raspberry Pi Zero W en una plataforma flexible y de bajo costo para pentesting, red teaming y compromisos físicos ... o en "A Little Offensive Appliance". 0. Cómo instalar La imagen más reciente se puede encontrar en la...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/10 8:54 p.m.13 views

rtl_433

rtl433 rtl433 despite the name is a generic data receiver, mainly for the 433.92 MHz, 868 MHz SRD, 315 MHz, 345 MHz, and 915 MHz ISM bands. The official source code is in the https://github.com/merbanan/rtl433/ repository. See also a list of software that works with rtl433 in the wiki. For more...

6AI score
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/10 8:53 p.m.8 views

test_avb_key

On Almost Signing Android Builds Introduction An error sometimes encountered by NCC Group consultants is signing Android builds with known private keys. This leaves the device manufacturers and in turn their users vulnerable, even on devices where secure boot is enabled. This blog post has two...

6AI score
SaveExploits0References1
Rows per page
Query Builder