CVE-2026-113725

A flaw was found in virtualenv. The bash activation script improperly escapes the virtual environment name when configuring the command prompt. If a user activates a virtual environment created with a specially crafted name, an attacker can achieve arbitrary code execution in the user's shell...

CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

DEBIAN-CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

Billion 5200W-T - Remote Command Injection

Unauthenticated or authenticated OS command injection in Billion 5200W-T via advremotelog.asp or toolstime.asp. Spawns utelnetd and opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 5200W-T remote command injection — opens framework shell session.""" from...

Grandstream GXV3611 HD - Telnet SQL Injection

SQL injection in the Grandstream GXV3611 HD telnet login resets the admin password to 'a', triggers the !/ port lol backdoor on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet SQLi — opens framework shell session.""" impo...

Modbus TCP Client

Connects to a Modbus TCP server and creates an interactive Modbus shell session !/usr/bin/env python3 -- coding: utf-8 -- """Modbus TCP bind listener — opens a Modbus session for interactive register access.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

GHSA-P26J-H7WJ-R568 wetty vulnerable to DOM XSS via file-download filename

Summary The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string escapeMarkup: false. Any output the victim renders - a cat'd file, a tailed log, an SSH MOTD, a curl response - that contains \x1b5i...:...\x1b4i runs scri...

EUVD-2026-39013

Warp is an agentic development environment. From 0.2021.04.25.23.05.stable00 until 0.2026.05.06.15.42.stable01, Warp accepted certain state-mutating terminal lifecycle hooks from the PTY stream without verifying that the hooks were emitted by Warp's shell integration for the active session. An...

CVE-2026-54686 Warp: DCS lifecycle hook spoofing can alter terminal session metadata

Warp is an agentic development environment. From 0.2021.04.25.23.05.stable00 until 0.2026.05.06.15.42.stable01, Warp accepted certain state-mutating terminal lifecycle hooks from the PTY stream without verifying that the hooks were emitted by Warp's shell integration for the active session. An...

CVE-2026-54686

Warp: CVE-2026-54686 enables DCS lifecycle hook spoofing in Warp’s PTY stream, allowing attacker-controlled terminal output to spoof lifecycle metadata (e.g., working directory, SSH transport metadata) for active sessions. Technical details in connected PoC describe additional remote command inje...

Android adbd TLS Auth Bypass (CVE-2026-0073)

Uses the adbd STLS/TLS EVPPKEYcmp authentication bypass to create an Android shell session over ADB TCP. !/usr/bin/env python3 -- coding: utf-8 -- """Android adbd EVPPKEYcmp TLS authentication bypass session module.""" import socket import time from kittysploit import from lib.protocols.adb.adbtl...

CVE-2026-7551

HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Attackers can invoke the /bridge spawn command with attacker-controlled command text that is forwarded...

CVE-2026-7551

HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Attackers can invoke the /bridge spawn command with attacker-controlled command text that is forwarded...

Elasticsearch Listener

Elasticsearch listener - creates interactive Elasticsearch shell session !/usr/bin/env python3 -- coding: utf-8 -- """ Elasticsearch listener - connects to an Elasticsearch cluster and creates an interactive session. """ from kittysploit import from elasticsearch import Elasticsearch from...

MSSQL Listener

Microsoft SQL Server listener - creates interactive MSSQL shell session !/usr/bin/env python3 -- coding: utf-8 -- """ MSSQL listener - connects to a Microsoft SQL Server and creates an interactive session. """ from kittysploit import import pymssql class ModuleListener: """MSSQL listener - create...

Redis Listener

Redis in-memory store listener - creates interactive Redis shell session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import redis class ModuleListener: info = 'name': 'Redis Listener', 'description': 'Redis in-memory store listener - creates interactive Redis shell session',...

EUVD-2019-10522

Malware in sbrugna...

EUVD-2025-27614

Malicious code in bioql PyPI...

Schneider Electric Saitel DR & Saitel DP Remote Terminal Unit

RISK EVALUATION Successful exploitation of these vulnerabilities could enable an attacker to execute arbitrary shell commands on the affected devices. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures...

CVE-2025-9996

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause the execution of any shell command when executing a netstat command using BLMon Console in an SSH session...