cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

CVE-2025-70994

CVE-2025-70994: Weak Authentication in Yadea T5 Electric Bicycle !WARNING This repository is published strictly for educational and academic security research purposes. The information and proof-of-concept code provided here are intended to demonstrate a known cryptographic flaw CWE-1390 to assis...

Rootsmart-v2.0

Rootsmart 2.0 w/ cve-2019-2215 + Ransomware Disclaimer This project is solely for educational purposes. This project utilise code from rkshrksh/2048-Game and kangtastic/cve-2019-2215. Project Description This project is part of Singapore Institute of Technology Mobile Security module. The project...

CVE-2012-5519

cups-root-file-read.sh ⭐ a bash implementation of the metasploit 'cupsrootfileread.rb' module designed for pentesting and CTFs. mainly a short exercise in bash scripting. intended to be a self-contained program that exploits CVE-2012-5519 on linux systems; it provides the user with an interactive...

CVE-2026-112946

A flaw was found in Vite. On network-accessible development servers, improper path resolution during import analysis can cause root-relative paths to be incorrectly marked as safe module paths. An unauthenticated remote attacker can exploit this issue by requesting specially crafted paths that...

CVE-2026-112949

A flaw was found in Vitest. An unauthenticated attacker able to connect to the development server can achieve cross-site scripting XSS by registering a crafted mock module with an unescaped URL. When a developer loads the affected module in their browser, attacker-controlled JavaScript executes...

cve-2026-31431-algif-aead-remediator

CVE-2026-31431 / GHSA-2274-3hgr-wxv6 — algifaead Remediator Severity: High CVSS 7.8 — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Background CVE-2026-31431 is a local privilege escalation vulnerability in the Linux kernel's algifaead module AFALG AEAD crypto socket interface. A low-privileged...

Exploit for CVE-2026-87690

CVE-2026-87690 Path traversal CWE-22 in Metasploit Framewor...

CVE-2026-113679

A flaw was found in HarfBuzz. An attacker can trigger an out-of-bounds write by enticing an application using the experimental WebAssembly Wasm shaper to process a specially crafted font. Due to an incorrect function signature in the glyph string conversion interface, the font's embedded...

CVE-2026-112945

A flaw was found in Vite. An attacker can achieve arbitrary script execution in a user's browser by convincing a victim to load a crafted development server page when an application uses custom middleware. Due to improper handling of leading slashes in request URLs during HTML transformation, the...

CVE-2026-43284-CVE-2026-43500-scan

DirtyFrag Scanner & Patcher Internal Network Tool for CVE-2026-43284 & CVE-2026-43500 Automated Linux LPE Audit & Mitigation via SSH Disclaimer : This tool is specifically designed for legitimate internal security audits. Using it without authorization against systems that are not yours is a...

CVE-2026-113680

A flaw was found in HarfBuzz. This vulnerability allows an attacker to cause a Denial of Service DoS by supplying a specially crafted font containing an embedded WebAssembly Wasm module. When an application shapes text using the malicious font, the module passes out-of-range memory addresses to...

CVE-2025-53786

CVE-2025-53786 Exploit This project provides a proof-of-concept PoC exploit targeting a critical vulnerability in Microsoft Exchange Server hybrid deployments, identified as CVE-2025-53786. This vulnerability allows an attacker with administrative access to an on-premises Exchange server to...

XCP_ng_CVE-2026-43284_tester

XCP-ng Dirty Frag Diagnostic — CVE-2026-43284 A community diagnostic tool to determine whether an XCP-ng dom0 host is exposed to CVE-2026-43284 "Dirty Frag", a local privilege escalation vulnerability in the Linux kernel's xfrm-ESP subsystem. TL;DR — All current XCP-ng releases 8.1, 8.2, 8.3...

panopticon

DEPRECATED The Panopticon project moved toGitlab and was restructed into multiple crates. The Qt GUI was replaced with Verso. I will merge PRs but won't do any substantial work on this version. Most links below are dead. Panopticon - A Libre Cross Platform Disassembler Panopticon is a cross...

Drupal_REST-RCE_Unauthenticated

CVE-2019-6340 — Drupal RESTful Web Services RCE Python implementation of the remote code execution exploit for CVE-2019-6340, based on analysis of the Metasploit module and the prior work by leonjza. Key difference from EDB-46459: uses POST instead of GET, bypassing Drupal's page cache — can be...

fire-wall-server

🛡️ Spring4Shell Firewall Mitigation Python Script This project simulates a firewall using Python's built-in http.server module to detect and block malicious requests exploiting the Spring4Shell CVE-2022-22965 vulnerability. 🔍 About Spring4Shell is a critical Remote Code Execution RCE vulnerability...

MAL-2026-18109 Malicious code in rs-lookout-sandbox-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c On module load, index.js reads os.userInfo.username and issues an HTTPS GET to a hardcoded third-party collector at...

Malicious code in rs-lookout-sandbox-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c On module load, index.js reads os.userInfo.username and issues an HTTPS GET to a hardcoded third-party collector at...

spring-cloud__spring-cloud-gateway_CVE-2022-22947_3-0-6

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-gateway/tree/master.svg?style=svg"CircleCI",...