CVE-2026-33149-PoC

CVE-2026-33149 — Host Header Injection in Tandoor Recipes Summary Tandoor Recipes sets ALLOWEDHOSTS = '' by default in settings.py, causing Django to accept any value in the HTTP Host header without validation. The application uses request.buildabsoluteuri to generate absolute URLs in multiple...

Geutebrueck_GCore_X64_RCE_BO

GeutebrueckGCoreX64RCEBO Metasploit module for Geutebrueck GCore "video management" system. Tested with version 1.3.8.42 and 1.4.2.37. Full remote code execution with NT/System privileges on Windows Win 2012R2,Win8.1,... with the installed Geutebrueck products GCore. Authors:...

PoC-CVE-2019-12840

Exploit for CVE-2019-12840 in Webmin This repository contains a Python script that exploits the CVE-2019-12840 vulnerability in Webmin. Description The script attempts to log in to a Webmin server and then exploit the CVE-2019-12840 vulnerability. The script accepts several command-line arguments...

Offensive-lab-2

Offensive security Lab : ProFTPD 1.3.3c Backdoor Exploit Root Flag 1. Introduction and Objectives This report details the penetration test performed on a vulnerable Linux virtual machine VM, focusing on identifying a high-risk service vulnerability that allowed for immediate root access. Detail|...

Security update for libraw

This update for libraw fixes the following issue: CVE-2026-88387: incorrect numeric conversion in LibRaw::parsetiffifd when processing TIFF tag 0x00fe can lead to undefined behavior and a process crash when a specially crafted file is processed bsc1282783. Patch Instructions: To install this SUSE...

Security update for openexr

This update for openexr fixes the following issue: CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file containing an unknown-type attribute with dataSize set to zero is processed bsc1282700. Patch Instructions: To install this SUSE update u...

Security update for openssh

This update for openssh fixes the following issues: CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses bsc1275075. CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free bsc1275074...

OurSharePoint-CVE-2025-53770

OurSharePoint — CVE-2025-53770 PoC Self-contained, single-binary SharePoint RCE tool. Generates a TypeConfuseDelegate gadget chain as raw MS-NRBF bytes no ysoserial.exe, wraps it in a DataSet deserialization payload, and delivers it over HTTP using the authentication bypass — all in one shot...

Sync_Breeze_Enterprise_10_6_24_-DOS

SyncBreezeEnterprise10624-DOS Exploit Title: Sync Breeze Enterprise 10.6.24 - Denial Of Service Vulnerability Date: 03-09-2018 Exploit Author: Ege Balcı Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.6.24.exe Version: 10.6.24 Teste...

CyberSec2026

Victim installation Start your VM in VirtualBox 1. Log in with: username: osboxes password: osboxes.org 2. Open a terminal 3. Test if you have a working internet connection. ping 8.8.8.8 If your ping is not successful, check if your NAT interface is enabled. 4. Update your OS sudo apt-get update ...

cve-2026-31431-copy-fail

CVE-2026-31431 "Copy Fail" Scanner & Patch Helper Copy Fail is an automated security scanner and patch helper for detecting and remediating the CVE-2026-31431 vulnerability Linux Kernel algifaead Local Privilege Escalation across your Linux infrastructure. Table of Contents Description Key Featur...

agent_tesla_panel_rce

agentteslapanelrce This module exploit the command injection vulnerability in control center of the agent Tesla. Setup Resources for testing are available here: https://github.com/mekhalleh/agentteslapanelrce/tree/master/resources Windows For WebPanel1.7z unauthenticated RCE, I used WAMP server...

Malicious code in moveworks-capi-starter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2cd8f99409a87f01743f65f381fefa800176a29d47d6119743ae2bd0ce1f7583 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18122 Malicious code in moveworks-capi-starter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2cd8f99409a87f01743f65f381fefa800176a29d47d6119743ae2bd0ce1f7583 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Security Bulletin: Multiple vulnerabilities in Python affect AIX

Summary Vulnerabilities in Python: SSL/TLS Security Vulnerabilities CVE-2026-19553, CVE-2026-19445, Archive Extraction / Tarfile Vulnerabilities CVE-2026-19672, CVE-2026-82049, CVE-2026-87910, Authentication / Credential Exposure CVE-2026-15806, Memory Management Vulnerabilities CVE-2026-15310,...

Security update for rootlesskit

This update for rootlesskit rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux...

Security update for docker

This update for docker rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...

trivy-module-wordpress

Trivy WoredPress Module This module provides a more in-depth investigation of Wordpress detection. Set up $ tinygo build -o wordpress.wasm -scheduler=none -target=wasi --no-debug wordpress.go $ mkdir -p /.trivy/modules $ cp wordpress.wasm /.trivy/modules It is also available in GHCR. You can...

Exploit for CVE-2026-109618

php-rfc1867-guard For PHP 5.4 to 8.1, which get no official f...

git-dump

git-dump This script is a tool to recursively download the contents of the '.git' directory from a website. Using Python and libraries like 'requests' and 'BeautifulSoup', this script examines the directory structure, downloads files, and identifies SHA-1 hashes within Git files. Feature...