CVE-2026-77620 Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nest...

CVE-2026-77619 Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

CVE-2026-77619

CVE-2026-77619 affects the logstash source in Vector (versions 0.15.0 through 0.57.0). The vulnerability stems from the source reading a 32-bit compressed-frame length from the network and sizing an in-memory buffer without an upper bound . An unauthenticated remote peer reaching the default 0.0....

CVE-2026-23744-MCPJam-Exploit

CVE-2026-23744 MCPJam Inspector RCE 익스플로잇 ⚠️ 면책 조항 이 도구는 승인된 보안 테스트 및 교육 목적으로만 사용해야 합니다. 무단 사용은 불법입니다. 사용자는 자신의 행동에 대한 모든 책임을 집니다. 📋 개요 이 저장소는 CVE-2026-23744 에 대한 개념 증명 익스플로잇으로, MCPJam Inspector 버전 =1.4.2에서 발견된 인증되지 않은 원격 코드 실행RCE 취약점입니다. 이 취약점은 네트워크 공격 벡터로 심각한 위험을 나타내는 CVSS 점수 9.8을 가지고 있습니다...

CVE-2026-50751

CVE-2026-50751 Check Point IKEv1 スキャナー CVE-2026-50751 用のマルチスレッド脆弱性スキャナー。Check Point Quantum Security Gateways に影響を与える重大なIKEv1認証バイパスの脆弱性です。 概要 IKEv1が有効なCheck Point Remote Access VPNシステムは、認証バイパス攻撃に対して脆弱です。このツールは、ターゲットシステムでIKEv1が有効かどうかを検出します。 CVE-2026-50751 詳細: CVSSスコア : 9.8 重大 脆弱性 : Check...

CVE-2022-21907

CVE-2022-21907 説明 root@kitploit: CVE-2022-21907 の POC: HTTP プロトコル スタックのリモート コード実行の脆弱性。 Malwareman により 2022-09-17 に作成。 詳細 root@kitploit: HTTP プロトコル スタックのリモート コード実行の脆弱性。 https://github.com/antx-code/CVE-2021-31166CVE-2021-31166 に類似。 この問題は、昨年 https://github.com/antx-code/CVE-2021-31166CVE-2021-31166...

sk-cve-2026-26030-lab

CVE-2026-26030 — Semantic Kernel 过滤器 eval 远程代码执行（实验室） 一个自包含的实验室，复现 CVE-2026-26030 ：通过 Microsoft Semantic Kernel（Python， 仅供伦理实验室使用。在专用 virtualenv 中隔离；payload 无害（在无头 PoC 中 touch 标记文件；在 UI 演示中 open -a Calculator），并以您自己的非特权用户身份运行。 设置 root@kitploit: ./setup.sh 构建两个隔离的 venv（1.39.3 易受攻击，1.39.4 已修补） 需要...

CVE-2026-9147-uproot-rce

CVE-2026-9147: TStreamerInfo メタデータを介した uproot コードインジェクション 重大度: 高, CVSS 4.0 8.5 , CVSS 3.1 7.8 （VulnCheck（CNA）によって割り当て） ベクター（v4.0）: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ベクター（v3.1）: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 影響を受けるバージョン: uproot = 5.7.4 修正バージョン: 5.7.5 /...

VehApiResolve

VehApiResolve Dridex Loader の32ビットAPI難読化に触発されました。 これはどのように機能するのか？ 例外ハンドラをセットアップします。 root@kitploit: AddVectoredExceptionHandler CALLFIRST, ApiResolverHandler ; この例外ハンドラは、EXCEPTIONBREAKPOINTとして投げられた例外のみを処理します。それが私たちによって投げられたとき、CONTEXTをキャプチャできます。渡された引数を取得できます。...

CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...

BIT-MONGODB-2026-18705 Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructin...

Fedora 45 : open62541 (2026-3fd073ad5b)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3fd073ad5b advisory. Update to 1.5.8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

CVE-2026-83357

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE component: Compiler. The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows...

CVE-2026-87284

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2026-87278

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2026-87264

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Integration Broker. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-87262

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Engineering Communication Interface. The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication...

CVE-2026-87240

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial...

CVE-2026-87203

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-83438

Vulnerability in the Oracle Engineering product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering. Whil...