PT-2026-105525

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed mcp tools function returning None instead of a denied result when mcp tools is omitted from a user's grant in deeptutor/multi user/too...

mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer

A flaw was found in MariaDB. During a State Snapshot Transfer SST, the donor node improperly validates parameters sent by a joiner node. This vulnerability allows a malicious joiner to execute arbitrary shell commands on the donor server through the mariabackup SST method. This could lead to a...

CVE-2026-10648

mcumgrserialprocessfrag in subsys/mgmt/mcumgr/transport/src/serialutil.c calls netbufreset on the result of smppacketalloc before checking it for NULL. smppacketalloc uses netbufallocKNOWAIT against the shared MCUmgr packet pool CONFIGMCUMGRTRANSPORTNETBUFCOUNT, default 4, which returns NULL when...

CVE-2026-34592 Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to the current team, allowing any authenticated user to access servers and projects belonging to other teams by specifying...

K000161970: Golang vulnerability CVE-2025-22869

Security Advisory Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. CVE-2025-22869 Impact An attack...

Shell Capability Profiler

Fingerprint an unusual shell and list available interpreters, transfer tools, TTY support, and execution constraints from kittysploit import class ModulePost: info = "name": "Shell Capability Profiler", "description": "Fingerprint an unusual shell and list available interpreters, transfer tools,...

Restricted Shell Audit

Identify restricted or atypical shell constraints, escape-capable binaries, sudo posture, and writable PATH risks from kittysploit import import re class ModulePost: info = "name": "Restricted Shell Audit", "description": "Identify restricted or atypical shell constraints, escape-capable binaries...

Slack Socket Mode Polling Shell

Uses Slack Socket Mode as a command/result transport for lab agents. !/usr/bin/env python3 -- coding: utf-8 -- import time from kittysploit import try: from slackbolt import App from slackbolt.adapter.socketmode import SocketModeHandler SLACKAVAILABLE = True except Exception: App =...

PostgreSQL NOTIFY Shell Listener

C2 over PostgreSQL LISTEN/NOTIFY channels. !/usr/bin/env python3 -- coding: utf-8 -- import json import select import threading import time from kittysploit import class ModuleListener: info = "name": "PostgreSQL NOTIFY Shell Listener", "description": "C2 over PostgreSQL LISTEN/NOTIFY channels.",...

Reverse MQTT Shell Listener

Command/result C2 over MQTT topics, separate from the generic MQTT pub/sub listener. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import time from kittysploit import class ModuleListener: info = "name": "Reverse MQTT Shell Listener", "description": "Command/result C2 over...

PHP Command Shell, Bind TCP

Listen on the target and expose a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Bind TCP', 'description': 'Listen on the target and expose a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP,...

PHP Command Shell, Reverse TCP

Connect back and create a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Reverse TCP', 'description': 'Connect back and create a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP, 'platform':...

CVE-2026-11979

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

CVE-2026-11979

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

UBUNTU-CVE-2026-11979

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

CVE-2026-11979 Stack-Based Buffer Overflow in libxml2

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

CVE-2026-11979 Stack-Based Buffer Overflow in libxml2

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

EUVD-2026-40092

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...