dlink-dir-819-dos

CVE-2022-40946 Exploit: Denegación de Servicio No Autenticada en routers domésticos DLink DIR 819 A1 Exploit Obtener las fuentes root@kitploit: $ git clone https://github.com/whokilleddb/dlink-dir-819-dos $ cd dlink-dir-819-dos $ pip install -r requirements.txt Ejecutar el exploit root@kitploit: ...

CVE-2026-38361

CVE-2026-38361: Múltiples vulnerabilidades de DoS no autenticadas en dash-uploader...

CVE-2026-49975-HTTP-2-Bomb

A triage not exploitation tool to identify attack surfaces exposed to CVE-2026-49975 — "HTTP/2 Bomb". ⚠️ This script does not send attack payloads. It only makes normal HTTP requests and analyzes response headers to flag hosts that warrant manual version/patch verification. About CVE-2026-49975...

cve-2026-34473-unauthenticated-dos-zte-routers

CVE-2026-34473: Denegación de servicio no autenticada en routers ZTE que afecta a más de 140 000 dispositivos en todo el mundo más de 17 modelos Desglose técnico de CVE-2026-34473, publicado a partir del conjunto de divulgación original y de los artefactos de análisis de firmware. Sitio en vivo:...

EUVD-2026-85411

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...

GHSA-5F42-97GR-VFHQ Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

moquette is reachable by untrusted MQTT clients anonymous by default, so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE I did not find one and do not...

CVE-2026-86608

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-56681

creationtimestamp| type| source ---|---|--- 2026-09-22 18:32:29+00:00| seen| https://gist.github.com/alon710/bf3a865551bb5c97cbf5b48608ac9014 2026-09-22 18:35:06+00:00| published-proof-of-concept| https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8 2026-09-23 02:58:05+00:00...

CVE-2026-28318-check

SolarWinds Serv-U DoS no autenticado: Script de detección seguro Un detector seguro, no destructivo para CVE-2026-28318 , una denegación de servicio no autenticada en SolarWinds Serv-U= 15.5.4.108. Una única POST que lleva Content-Encoding: deflate y un cuerpo alimenta ese cuerpo a un descompreso...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

GHSA-JR34-H97M-9HPX nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

CVE-2026-77561

The Tinyauth authentication server is vulnerable to a denial of service (DoS) attack in versions prior to 5.1.0 . An unauthenticated remote attacker can send POST /api/user/login requests using 257 distinct nonexistent usernames to exhaust the MaxLoginAttemptRecords cap. This triggers a global lo...

EUVD-2026-83910

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled...

servu-cve-2026-28318-poc

CVE-2026-28318 — SolarWinds Serv-U "Content-Encoding: deflate" caída pre-autenticación Análisis de causa raíz + prueba de concepto de DoS. El aviso público clasifica esto como una denegación de servicio / consumo no controlado de recursos no autenticada. El análisis binario muestra que el defecto...

Wincrash

Wincrash root@kitploit: 本人不对你使用此工具所达成的一切后果负责，该工具仅应用于教育目的。CVE-2019-0708 —— 当未认证的攻击者通过RDP连接到目标系统并发送特制请求时，存在远程桌面服务远程代码执行漏洞。此漏洞利用程序仅使设备崩溃，不执行代码 截图 alt text alt text 安装： root@kitploit: $ apt-get install python3 python3-pip $ cd Wincrash $ pip3 install -r requirements.txt 联系方式 Telegram: @ethhacker0x18...

Unauthenticated-CVE-2020-0796-PoC

Prueba de concepto sin autenticación para CVE-2020-0796 Todos los scripts de prueba de concepto que he visto hasta ahora requieren tanto un nombre de usuario como una contraseña. Por lo tanto, decidí publicar mi propio PoC. No es nada sofisticado, pero funciona. No requiere módulos adicionales y...

CVE-2023-40459

CVE-2023-40459 CVE-2023-40459 未认证的拒绝服务（DoS）PoC利用程序。 该漏洞影响 Sierra Wireless 产品 ALEOS 4.16 及更早版本的 ACEManager 组件。 用法 python3 PoC-CVE-2023-40459.py Address: http://target Port: 9091 参考 NVD 文章 Double Take Zero Day...

CVE-2026-67184-Unauthenticated-NULL-Pointer-Dereference-Crashes-the-Server-TinyWeb-

Aviso de seguridad: La desreferencia de puntero NULL no autenticada provoca el bloqueo del servidor TinyWeb ID de CVE asignado: CVE-2026-67184 Resumen Cuando TinyWeb no puede analizar una línea de solicitud, devuelve un error pero deja el puntero URL de la solicitud establecido en NULL. El llamad...

CVE-2024-10511

CVE-2024-10511 CWE-287: Autenticación incorrecta Resumen El producto PowerChute Serial Shutdown de Schneider Electric es un software de gestión de UPS que permite un apagado ordenado del sistema y capacidades de gestión de energía para equipos de escritorio, servidores y estaciones de trabajo...

EUVD-2026-83207

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query...