qu1ckdr0p2

About Rapidly host payloads and post-exploitation bins over HTTP or HTTPS. Designed to be used on exams like OSCP / PNPT or CTFs HTB / etc. Pull requests and issues welcome. As are any contributions. Qu1ckdr0p2 comes with an alias and search feature. The tools are located in the qu1ckdr0p2-tools...

CVE-2026-47668

CVE-2026-47668 — Ejecución Remota de Código en DbGate RCE no autenticado en el ejecutor de scripts JSON de DbGate dbgate-serve ≤ 7.1.8. Herramienta de evaluación: CVE-2026-47668.py — solo para pruebas autorizadas. | ---|--- CVE| CVE-2026-47668 Severidad| Crítico Producto| DbGate / dbgate-serve...

CVE-2026-96286 Apache Thrift: Perl servers end `serve()` when serving one connection fails

Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96286 Apache Thrift: Perl servers end `serve()` when serving one connection fails

Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96277 Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

SUSE CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

CVE-2026-84292 vulnerabilities

Vulnerabilities for packages: vitess, commercial-gitlab-rails-ee, wazuh-dashboard-fips, gitlab-rails-ce, keep, serve, jupyter-base-notebook, keep-fips, unleash, yaml-language-server, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, nextcloud-server, opensearch-dashboards, prism,...

CVE-2026-84394 vulnerabilities

Vulnerabilities for packages: vitess, commercial-gitlab-rails-ee, wazuh-dashboard-fips, gitlab-rails-ce, keep, serve, unleash, keep-fips, yaml-language-server, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, nextcloud-server, opensearch-dashboards, prism, wazuh-dashboard, renovate,...

GHSA-58MR-GQGX-XQ4G vulnerabilities

Vulnerabilities for packages: vitess, commercial-gitlab-rails-ee, wazuh-dashboard-fips, gitlab-rails-ce, keep, serve, unleash, keep-fips, yaml-language-server, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, nextcloud-server, opensearch-dashboards, prism, wazuh-dashboard, renovate,...

GHSA-QW65-CVWX-89V3 vulnerabilities

Vulnerabilities for packages: vitess, commercial-gitlab-rails-ee, wazuh-dashboard-fips, gitlab-rails-ce, keep, serve, jupyter-base-notebook, keep-fips, unleash, yaml-language-server, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, nextcloud-server, opensearch-dashboards, prism,...

GHSA-QW65-CVWX-89V3 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, renovate, prism, jupyter-base-notebook, serve, vitess, yaml-language-server...

GHSA-58MR-GQGX-XQ4G vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, renovate, prism, serve, vitess, yaml-language-server...

CVE-2026-84292 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, renovate, prism, jupyter-base-notebook, serve, vitess, yaml-language-server...

CVE-2026-84394 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, renovate, prism, serve, vitess, yaml-language-server...

BIT-RCLONE-2026-93987 rclone serve docker Path Traversal via Volume Name

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

PT-2026-102747

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

PT-2026-102889

Found a High issue in dbt Core v2 alphas - CVE-2026-100406. : dbt docs serve had an open query endpoint with no login. If that server was reachable, local files like creds and keys could leak. Fixed in 2.0.0-alpha.5. Upgrade and keep docs serve local. https://t.co/o5ISFpV6cb...

BIT-RCLONE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-97875

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

EUVD-2026-86991

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...