W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

CVE-2025-4334

🔓 Simple User Registration = 6.3 - Escalada de Privilegios No Autenticada 📄 Descripción El plugin Simple User Registration para WordPress es vulnerable a una Escalada de Privilegios en todas las versiones hasta la 6.3 inclusive. Esto se debe a restricciones insuficientes en los valores meta de...

wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...

urlbuster

root@kitploit: ██╗ ██╗██████╗ ██╗ ██████╗ ██╗ ██╗███████╗████████╗███████╗██████╗ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║██╔════╝╚══██╔══╝██╔════╝██╔══██╗ ██║ ██║██████╔╝██║ ██████╔╝██║ ██║███████╗ ██║ █████╗ ██████╔╝ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║╚════██║ ██║ ██╔══╝ ██╔══██╗ ╚██████╔╝██║...

CVE-2023-50257

Reproducción del CVE-2023-50257 en ROS2 🔍 Resumen Este repositorio se basa en un PoC para CVE-2023-50257 y automatiza la recopilación de paquetes RTPS, analiza valores GUID y envía un paquete DoS exitoso. CVE-2023-50257 es una vulnerabilidad de seguridad conocida en ROS2 Robot Operating System 2...

CVE-2026-19543

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit...

CVE-2026-19543 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit...

EUVD-2026-77461

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache...

Astra Linux – Vulnerability in OpenLDAP

A flaw was discovered in OpenLDAP before version 2.4.57, which led to a crash in the slapd process during control handling of the Values Return Filter. This caused a denial of service attack, involving double-free operations and out-of-bounds reads...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, as well as 10.0.0 and 11.0.0, when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e., q parameters, the server may enter a Denial-of-Service DoS state due to high CPU usage in processing...

http-protocol-exfil

http-protocol-exfil Use the HTTP protocol version to send a file bit by bit "HTTP/1.0" is a 0 and "HTTP/1.1" is a 1. It uses GET requests so the Blue Team would only see the requests to your IP address. However, it takes a long time to send bigger files, for example it needs 1 hour to send 200 KB...

CVE-2026-82784

Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output...

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-81016 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amdstbs2dinit discards the return value of several S2D SMU commands. When the SMU refuses a command e.g. "SMU cmd failed. err: 0xff" the failure is only noticed...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Aviso de Seguridad: Inyección en Cabeceras HTTP mediante CR y LF sin Validar en Valores de Cabecera tinyhttp ID de CVE asignado: CVE-2026-66753 Resumen tinyhttp no rechaza el retorno de carro ni el avance de línea dentro de los valores de las cabeceras HTTP, en ninguna de las dos direcciones. En ...

CVE-2026-89249

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in walletlog.information. Administrators viewing pending...

RLSA-2026:66403 Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values CVE-2026-56392 For more details about the...

CVE-2026-42533

CVE-2026-42533 — nginx: sobrescritura de captura en dos pasadas two-pass capture clobbering nginx 0.9.6–1.30.3 / mainline ≤1.31.2 desbordamiento de montón preautenticación + fuga de información en el motor de scripts de valores complejos; CVSS 9.2. La misma causa raíz tiene dos superficies de...

AlmaLinux 9 : coreutils (ALSA-2026:66403)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:66403 advisory. coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values CVE-2026-56392 Tenable has extracted the preceding description block directly fro...