1308 matches found
qu1ckdr0p2
About Rapidly host payloads and post-exploitation bins over HTTP or HTTPS. Designed to be used on exams like OSCP / PNPT or CTFs HTB / etc. Pull requests and issues welcome. As are any contributions. Qu1ckdr0p2 comes with an alias and search feature. The tools are located in the qu1ckdr0p2-tools...
PT-2026-137186
Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22 Description An issue exists in the mg path is sane function within src/util.c where the system reads path.buf1 without verifying that path.len is at least two bytes, and reads s2 when only two bytes remain...
CVE-2026-47668
CVE-2026-47668 — DbGate Remote Code Execution Unauthenticated RCE in DbGate JSON Script Runner dbgate-serve ≤ 7.1.8. Assessment tool: CVE-2026-47668.py — authorized testing only. | ---|--- CVE| CVE-2026-47668 Severity| Critical Product| DbGate / dbgate-serve Affected| ≤ 7.1.8 Fixed| ≥ 7.1.9 CVSS...
CLEANSTART-2025-NT99935 problem with the implementation of the new serve-stale feature in BIND 9
Security vulnerability affects the bind package. A problem with the implementation of the new serve-stale feature in BIND 9...
CLEANSTART-2025-AE08215 bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled
Security vulnerability affects the bind package. A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled...
EUVD-2026-111387
russh's SSH agent server is susceptible to unbound allocations via repeated SSHAGENTCONSTRAINCONFIRM messages...
GHSA-F3FJ-9625-RV3M charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
Summary Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. SetPrivate cleared the cached record before it saved the new visibility, and not afterwards. A request that arrived between the two read the old, public record from the...
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
Summary Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. SetPrivate cleared the cached record before it saved the new visibility, and not afterwards. A request that arrived between the two read the old, public record from the...
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
Summary Soft Serve answers Go's ?go-get=1 requests by walking up the requested path until it finds a repository, then rendering that repository's name and clone URL into a go-import meta tag. The walk checked that each candidate repository existed, but never that the caller could read it. A reque...
GHSA-FGXM-5HVV-X4VH charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
Summary Soft Serve answers Go's ?go-get=1 requests by walking up the requested path until it finds a repository, then rendering that repository's name and clone URL into a go-import meta tag. The walk checked that each candidate repository existed, but never that the caller could read it. A reque...
Rclone 1.75.1 Path Traversal
Rclone versions before 1.75.2 contain a path traversal vulnerability in serve webdav that can permit writes above the served root. This tool performs offline inventory-based version exposure assessment...
BIT-RCLONE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests
Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...
BIT-RCLONE-2026-116192 rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to...
BIT-RCLONE-2026-116191 Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, o...
BIT-RCLONE-2026-116188 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow
rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...
BIT-RCLONE-2026-116187 Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject part...
PT-2026-132476
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, o...
PT-2026-132473
rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...
PT-2026-132477
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to...
PT-2026-132472
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject part...