CVE-2026-72924

A flaw was found in GitHub CLI. The gh codespace ports forward command, by default, exposes forwarded services on all local network interfaces. This allows a network-adjacent attacker to access these services through the user's machine while port forwarding is active, even if the original...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

CVE-2018-9995-rs

Overview This repository contains a proof-of-concept PoC exploit implemented in Rust targeting CVE-2018-9995. The code is for research and educational purposes only. CVE Details Identifier: CVE-2018-9995 Summary: Proof-of-concept exploit demonstrating the vulnerability see public advisories for...

CVE-2026-0257

🚨 CVE-2026-0257 - प्रमाणीकरण बायपास कमजोरियाँ PAN-OS: GlobalProtect प्रमाणीकरण बायपास कमजोरियाँ GlobalProtect पोर्टल और गेटवे में प्रमाणीकरण बायपास 📌 अवलोकन CVE-2026-0257 एक प्रमाणीकरण बायपास कमजोरी है जो Palo Alto Networks PAN-OS सॉफ़्टवेयर के GlobalProtect पोर्टल और गेटवे घटकों को प्रभावित करती...

CVE-2025-36911-exploit

WhisperPair Python CLI أداة استغلال سريعة لثغرة CVE-2025-36911 مكتوبة بلغة Python لاختبار أجهزتنا المؤلف: Sébastien Dudek @FlUxIuS @ Penthertz الفضل: whisperpair.eu لاكتشاف الثغرة، وتطبيق APK الرائع من @ZalexDev الذي اختصر وقت التنفيذ wpair-app ⚠️ إخلاء مسؤولية لأغراض البحث الأمني المصرّح به فقط...

CVE-2026-63030

CVE-2026-63030 WordPress REST API batch रूट कन्फ्यूजन + SQL इंजेक्शन से अनधिकृत एडमिन निर्माण → रिमोट कोड निष्पादन तक की पूर्ण एक्सप्लॉइट श्रृंखला PoC। केवल अधिकृत सुरक्षा परीक्षण, भेद्यता पुनरुत्पादन और अनुसंधान हेतु। अनधिकृत लक्ष्यों पर उपयोग निषिद्ध। भेद्यता सारांश...

PT-2026-84047

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the media move endpoint where permission checks are derived from the client-supplied collection value rather than the actual source collection of the med...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

EUVD-2026-68876

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

wpair-app

WPair CVE-2025-36911 ex WhisperPair Scanner de vulnérabilités et outil de recherche Fonctionnalités • Installation • Utilisation • Fonctionnement • Vulnérabilité • Crédits Avertissement Cette application est une implémentation indépendante créée par @ZalexDev de sa propre initiative. Les chercheu...

CVE-2024-0044

CVE-2024-0044 نظرة عامة CVE-2024-0044 هي ثغرة أمنية اكتُشفت في بعض تطبيقات أندرويد تسمح للمهاجمين بتصعيد الامتيازات عبر استغلال خلل في أمر run-as. يمكن استغلال هذه الثغرة من خلال إنشاء حمولة Payload محددة تمنح وصولاً غير مصرح به إلى دلائل بيانات التطبيقات، والتي ينبغي أن تكون غير قابلة للوصول من...

CVE-2026-81643

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340 : Vulnérabilité de référence directe d'objet non sécurisée IDOR dans SOGo Webmail ID CVE : CVE-2025-50340 Signaleur : Milad Seddigh Produit : SOGo Versions affectées : v5.6.0 Impact : Vulnérabilité de référence directe d'objet non sécurisée IDOR → Permet à l'utilisateur d'envoyer d...

CVE-2022-31798

CVE-2022-31798 शोषण शीर्षक: Nortek Linear eMerge E3-Series - खाता अधिग्रहण...

CVE-2018-10933

CVE-2018-10933 का POC libssh के सर्वर-साइड स्टेट मशीन में संस्करण 0.7.6 और 0.8.4 से पहले एक कमजोरी पाई गई। एक दुर्भावनापूर्ण क्लाइंट पहले प्रमाणीकरण किए बिना चैनल बना सकता था, जिससे अनधिकृत पहुंच हो सकती थी। उपयोग : root@kitploit: python3 libssh.py -s SERVERADD -u USERNAME -c COMMMANDTOEXEC मूल...

PWNtaho

PWNentaho تجاوز المصادقة في Pentaho CVE-2021-31602 https://nvd.nist.gov/vuln/detail/CVE-2021-31602...

Joomla-Scanner

Joomla Scanner Joomla Unauthorized Access Vulnerability CVE-2023-23752 made with python Usage Display Result.txt URL | Database Name | Username | Password | Host Disclaimer Alat ini hanya untuk edukasi, dilarang memperjual beli kan dan menyalahgunakan...

CVE-2023-22515

CVE-2023-22515 CVE-2023-22515 Confluence Broken Access Control Exploit وصف الثغرة إضافة مستخدم مدير بدون إذن في Confluence USAGE Build root@kitploit: 源码编译 go mod init CVE-2023-22515 go mod tidy go build -ldflags="-s -w" -trimpath -o CVE-2023-22515.exe .\CVE-2023-22515.go Run root@kitploit:...

CVE-2018-10933

CVE-2018-10933 A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access. SOME DETAILS The issue comes from the way libssh doesn't maintain sta...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner Apache APISIX Dashboard versioni precedenti 2.10.1 presentano una vulnerabilità di sicurezza relativa all'accesso non autorizzato. La Manager API utilizza due framework e introduce il framework droplet sulla base del framework gin; tutte le API e i middleware di...