CVE-2026-93710 Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...

CVE-2026-93710

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...

CVE-2026-93709 Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl contain a path-normalization bypass in the AutoPage handler (disabled by default, enabled via auto_page). The handler compares the request path against the layout directory name as plain text, while the subsequent file lookup canonicalises the path. This mis...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

CVE-2024-33676

CVE-2024-33676 Enel X JuiceBox Level 2 电动汽车充电器上的弱身份验证和授权机制，使攻击者能够访问操作系统功能和参数。 描述 本地电动汽车充电器 WLAN 网络上的用户可以提取个人身份信息 PII、更改设置并操纵操作系统文件系统。 这可以通过访问端口 2000 上的本地 Gecko OS 接口功能来实现。 该信息已于 2025 年 7 月 26 日在 BSides Albuquerque 大会上公布。幻灯片位于 此处。 产品详情 受影响厂商：Enel X Way 受影响产品：JuiceBox Level 2 充电器 影响范围：Enel X...

PressVector

🧨 PressVector — WordPress CVE-2026-63030 / CVE-2026-60137 Exploitation Framework ⚡ Advanced Pre-Auth RCE & Blind SQLi Exploitation Framework for WordPress Core 📌 Overview PressVector is a comprehensive, fully automated exploitation framework targeting CVE-2026-63030 and CVE-2026-60137 — two...

CVE-2026-48907

🚨 CVE-2026-48907 - JCE Joomla Content Editor Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in JCE Joomla Content Editor A critical access control vulnerability allowing unauthenticated attackers to compromise vulnerable Joomla installations running JCE. 📖 Overview...

CVE-2026-23744-MCPJam-Exploit

CVE-2026-23744 MCPJam Inspector RCE Exploit ⚠️ DISCLAIMER This tool is for authorized security testing and educational purposes ONLY. Unauthorized use is illegal. Users assume all responsibility for their actions. 📋 Overview This repository contains a proof-of-concept exploit for CVE-2026-23744 ,...

CVE-2023-35078

CVE-2023-35078 Shodan 搜索语法 你可以使用以下 Shodan 搜索语法来查找公开目标。 http.favicon.hash:362091310 http.favicon.hash:545827989 path=/mifs 你可以使用以下命令将 Shodan API 返回的数据转换为适合检测脚本的格式： root@kitploit: jq -cr 'select.http.favicon.hash == 362091310 | if .ssl? then "https://" else "http://" end , .ipstr + ":" +...

nextjs-middleware-exploit

Next.js 中间件漏洞研究 CVE-2025-29927 此仓库演示了 Next.js 中间件中的一个严重 漏洞 （CVE-2025-29927），影响版本为 11.1.4 至 15.1.7。该漏洞允许通过缓存投毒实现 授权绕过 、CSP 绕过 以及潜在的 DoS 攻击 。问题源于 x-middleware-subrequest 请求头的处理方式，使得攻击者能够绕过中间件保护机制。 此概念验证专门针对 v12 中的漏洞。 使用方法 环境搭建 使用 docker 和本仓库中的文件来搭建易受攻击的环境，运行以下命令： root@kitploit: git clone...

CVE-2019-5418

CVE-2019-5418 - Divulgación de contenido de archivos en Rails EDIT : esta CVE puede provocar una ejecución remota de código, más información: https://github.com/mpgn/Rails-doubletap-RCE Existe una posible vulnerabilidad de divulgación de contenido de archivos en Action View. Las cabeceras accept...

CLEANSTART-2026-YY11796 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-UP97351 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-KN43296 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-XR77764 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-AL86944 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-GJ17760 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the argo-cd package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-XY58931 Previously, a channel registered in the mux's chanList is not usable until it is established

CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-TD63490 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the argo-cd package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...