Flowise-CVE-2025-58434-Chain-59528

FlowiseAI CVE Chain - ATO CVE-2025-58434 and RCE CVE-2025-59528 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents This repository contains a Python proof-of-concept for chainin...

CVE-2026-54415-PoC

CVE-2026-54415 — Azuriom CMS: нарушенный контроль доступа → захват учетной записи Отсутствие авторизации в маршрутах управления серверами админ-панели в Azuriom CMS Этот PoC публикуется в защитных и образовательных целях для исправленной версии. Запускайте его только на системах, которыми вы...

PT-2026-104752

Name of the Vulnerable Software and Affected Versions Perforce P4 Search versions prior to 2026.4.2 Description Container images reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can use this to obtain the highest...

PT-2026-106187

Name of the Vulnerable Software and Affected Versions Ghost versions 4.39.0 through 6.63.0 Description Staff users with permission to view staff invites can discover the secret token of pending invites. This includes invites for roles with higher privileges than the user's own, which could allow ...

PT-2026-106211

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description Logout functionality clears the browser's auth-token cookie but fails to revoke the corresponding server-side session. This allows a previously captured session token to remain valid and be used to...

CVE-2026-59358 - UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type. | Cloud Foundry

Severity High CVSS score: 7.6 High CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – All versions from UAA v3.7.0 to v79.6.0 inclusive; CF Deployment – All versions to v60.4.0 inclusive...

Debian dla-4822 : ruby-oauth2 - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4822 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4822-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-105675: Observable Discrepancy

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

Linux Distros Unpatched Vulnerability : CVE-2026-105217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the...

PT-2026-106014

Name of the Vulnerable Software and Affected Versions @insumermodel/mppx-condition-gate versions prior to 3.0.0 @insumermodel/mppx-token-gate versions prior to 1.0.4 Description These packages provide conditional free-access wrappers for mppx payment methods. The issue occurs when the software...

DotCMS-CVE-2022-45782

CVE-2022-45782 – dotCMS Предсказуемость токена сброса пароля PoC Этот репозиторий содержит proof-of-concept эксплойт для CVE-2022-45782, уязвимости в dotCMS, где токены сброса пароля генерируются с использованием не криптографического метода RandomStringUtils.randomAlphanumeric. Поскольку этот...

CVE-2020-24033

La dernière version du S3900 24T4S de fs.com 1.7.1 et toutes les versions précédentes, administration CSRF en coulisses Le formulaire ne dispose pas d'un mécanisme d'authentification ou de jeton d'authentification, il existe donc une vulnérabilité de type Cross-Site Request Forgery Ajout de compt...

Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

MAL-2026-17525 Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

CVE-2025-68860

CVE-2025-68860 Плагин WordPress Mobile builder Уязвимость «Обход аутентификации с использованием альтернативного пути или канала» в Mobile Builder допускает злоупотребление аутентификацией. Эта проблема затрагивает Mobile builder с n/a по 1.4.2. Оценка CVSS: 9.8 CRITICAL Вектор:...

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE Этот эксплойт восстанавливает и использует CVE-2019-16098, который находится в драйвере Micro-Star MSI Afterburner 4.6.2.15658 также известном как RTCore64.sys и RTCore32.sys, позволяет любому аутентифицированному пользователю читать и записывать в произвольную...

CVE-2024-26229-BOF

CVE-2024-26229 BOF Beacon Object File implementation of CVE-2024-26229 — Windows CSC driver local privilege escalation via DKOM token theft. Based on RalfHacker/CVE-2024-26229-exploit, converted to BOF with Dynamic Function Resolution DFR for use with C2 frameworks that support the Cobalt Strike...

ida-pro-mcp

IDA Pro MCP ⚠️ Archived — superseded by the official Hex-Rays IDA MCP server This project is no longer maintained. On 2026-09-27 Hex-Rays SA released the Official IDA MCP Server and IDA Nexus. Development stopped the same day at 1.0.0a4. For current use, install theirs: uvx ida-hcli mcp install. I...

CVE-2022-41544

CVE-2022-41544 Эксплойт-скрипт Этот репозиторий содержит скрипт для эксплуатации уязвимости CVE-2022-41544 в GetSimple CMS. Скрипт выполняет несколько шагов: проверяет наличие уязвимостей, извлекает ключи API, устанавливает cookies, получает CSRF-токены, загружает оболочку и запускает её. Изменен...

MetabaseRCE_CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 PoC Une preuve de concept de CVE-2023-38646, une exploitation de Metabase qui permet à un utilisateur d'exécuter du code à distance en utilisant le jeton d'initialisation trouvé dans /api/session/properties pour envoyer une charge utile encodée en base64...