GitLab 18.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-85706)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authenticatio...

Linux Distros Unpatched Vulnerability : CVE-2026-92039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

PT-2026-93272

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

Linux Distros Unpatched Vulnerability : CVE-2026-63128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in...

GitLab 18.4.6 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-1168)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...

CVE-2022-30114

Desbordamiento de búfer en 'cmproxy' de Fastweb FastGate CVE-2022-30114 Introducción Este script es una prueba de concepto PoC de CVE-2022-30114 y provoca un reinicio de los routers domésticos Fastweb FastGate , tanto en la versión GPON como en VDSL2. CVE-2022-30114 es un desbordamiento de búfer...

CVE-2026-41089

CVE-2026-41089 root@kitploit: ██████╗██╗ ██╗███████╗ ██╗ ██╗ ██╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ██║ ██║███║██╔═████╗██╔═████╗ ██║ ██║ ██║█████╗ ███████║╚██║██║██╔██║██║██╔██║ ██║ ╚██╗ ██╔╝██╔══╝ ██╔══██║ ██║████╔╝██║████╔╝██║ ╚██████╗ ╚████╔╝ ███████╗ ██║ ██║ ██║╚██████╔╝╚██████╔╝ ╚═════...

CVE-2022-39841

CVE-2022-39841 WebSocket con fugas de Medusa Para más información, lea la publicación del blog Resumen Una vulnerabilidad crítica en Medusa permite la filtración de información, incluidas credenciales en texto plano, al conectarse a un WebSocket no autenticado y esperar a que un usuario realice u...

CVE-2021-26855-PoC

CVE-2021-26855-PoC Código de exploit PoC para CVE-2021-26855. El código original fue desarrollado por https://github.com/GreyOrder. CVE-2021-26855 ssrf uso simple de ejercicios golang Versión afectada root@kitploit: Exchange Server 2013 es menor que CU23 Exchange Server 2016 es menor que CU18...

Webmin_CVE-2019-15107

CVE-2019–15107 - Webmin =1.920 未授权远程代码执行 此 Python 脚本可在 Webmin 1.890 上获取 root shell。 使用 nmap 检测： nmap -sC -sV -p 10000 TARGETIP 结果： 10000/tcp open http MiniServ 1.890 Webmin httpd 如何使用此漏洞： 步骤 1： nc -lnvp LPORT 步骤 2： chmod +x exploit.py root@kitploit: ./exploit RHOST RPORT LHOST LPORT RHOST = 目标主机...

CVE-2022-26810

Exploit RCE CVE-2022-26809 Descripción de la CVE La CVE-2022-26809 es una debilidad en un componente central de Windows RPC que obtuvo una puntuación CVSS de 9.8 no sin razón, ya que el ataque no requiere autenticación y puede ejecutarse remotamente a través de la red, y puede resultar en la...

weblogic2021

本项目涉及到的仅为安全研究和授权情况下使用，其使用人员有责任和义务遵守当地法律条规。 weblogic2021 CVE-2021-1994、CVE-2021-2047、CVE-2021-2064、CVE-2021-2108、CVE-2021-2075、CVE-2019-17195、CVE-2020-14756、CVE-2021-2109...

CVE-2021-21978

CVE-2021-21978 带回显版本的漏洞利用脚本，更简单的方式 0. 漏洞信息 VMware View Planner Web管理界面存在一个上传日志功能文件的入口，没有进行认证且写入的日志文件路径用户可控，通过覆盖上传日志功能文件loguploadwsgi.py，即可实现RCE 漏洞代码： root@kitploit: def applicationenviron, startresponse: logger.debug"application called" if environ'REQUESTMETHOD' == 'POST': post = cgi.FieldStorage...

CVE-2023-28810

CVE-2023-28810 Código de exploit para CVE-2023-28810. udp-config-changer.py Cambia la configuración en ejecución de un intercomunicador hikvision objetivo sin necesidad de autenticación alguna. udp-password-brute.py Intenta recuperar la contraseña de administrador del dispositivo mediante...

CVE-2026-15638 Cryptographic Padding Oracle

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...

CVE-2026-15638

Delinea Secret Server is affected by a cryptographic padding oracle vulnerability (CVE-2026-15638). An unauthenticated user with network access to the server can leverage the oracle to decrypt or encrypt data using one of the server's cryptographic keys; however, the key itself is not directly ex...

CVE-2022-26134

CVE-2022-26134 PoC Confluence Server y Data Center - CVE-2022-26134 - PoC de vulnerabilidad crítica de ejecución remota de código no autenticada Gravedad Atlassian califica el nivel de gravedad de esta vulnerabilidad como crítico, según la escala publicada en los niveles de gravedad de Atlassian...

CVE-2026-73459 Security Advisory 0160

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss...

CVE-2026-73459

CVE-2026-73459 affects Arista EOS with IS-IS configured (versions 4.36.1F and below in the 4.36.x train). An unauthenticated attacker in the same Layer 2 domain can inject a specially crafted IS-IS LSP PDU, causing the legitimate LSP to be purged from the link-state database due to a checksum val...

CVE-2025-9816

CVE-2025-9816 XSS Almacenado en el Plugin WP-Statistics Escáner Detección y PoC "El plugin WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del encabezado User-Agent en todas las versiones hasta, e incluyend...