CVE-2026-77194

The Simple Membership WordPress plugin (versions up to 4.8.0 , with a partial fix in 4.8.1) is affected by an unauthenticated Authentication Bypass that can lead to Administrator Account Takeover in WordPress Multisite environments. The root cause is improper identity verification during the publ...

CVE-2026-80675

A flaw was found in libbpf, a library for working with eBPF extended Berkeley Packet Filter programs in the Linux kernel. This vulnerability occurs when the signed loader fails to ensure that metadata maps are exclusive during verification. A hostile host could exploit this by omitting exclusivit...

CVE-2026-82662

A flaw was found in Nodemailer where it disables Transport Layer Security TLS certificate verification. A remote attacker, positioned between the user and the server a machine-in-the-middle attack, could exploit this by intercepting OAuth2 token requests. This allows the attacker to capture...

libfido2

== libfido2 image:https://github.com/yubico/libfido2/workflows/linux/badge.svg"Linux Build Status github actions", link="https://github.com/Yubico/libfido2/actions" image:https://github.com/yubico/libfido2/workflows/macos/badge.svg"macOS Build Status github actions",...

CVE-2021-26084-Nuclei-template

CVE-2021-26084-Nuclei-template 이 Nuclei 템플릿은 대상 머신에 명령어를 실행하지 않고 취약점을 확인하기 위한 것입니다...

React2Shell-Vulnerability-Verification-Script

Script de vérification de la vulnérabilité React2Shell verifyreactvulnerability.py Qu'est-ce que ce script ? Ceci est un script Python simple et autonome créé pour vous aider à déterminer rapidement si votre projet est affecté par la vulnérabilité critique React2Shell également connue sous le nom...

CVE-2023-33246

CVE-2023-33246 - RocketMQ Remote Code Execution CVE-2023-33246 - Apache RocketMQ config Remote Code Execution Exploit Overview RocketMQ is a distributed messaging and streaming platform. RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is...

project_bias

projectbias Высокопроизводительный криптографический потоковый движок без смещения, написанный на Ada и формально верифицированный с помощью SPARK. Движок гарантирует нулевое статистическое смещение при отображении сырой энтропии в пользовательские алфавиты, отбрасывая значения со смещением от...

CVE-2021-21985

CVE202121985 Описание Этот скрипт проверяет уязвимость CVE-2021-21985 и патч на vCenter Server. Требования Python3 Стандартная библиотека Python3 Установка root@kitploit: git clone https://github.com/mauricelambert/CVE202121985.git ./ Пример Для проверки IP 10.0.0.2, 10.0.0.3 и имени хоста...

CVE-2025-7955

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - ringcentraladminlogin2faverify 함수의 서버 측 검증 누락으로 인한 인증 우회 🚨 CVE-2025-7955 | RingCentral Communications WordPress 익스플로잇 📝 취약점 개요 CVE: CVE-2025-7955 영향 받는 플러그인: RingCentral Communications WordPress 영향 받는 버전: 1.5 – 1.6.8 CVSS 점수: 9.8 치명적 유형: 인증 우...

CVE-2026-59243_exploit

CVE-2026-59243 — Обход аутентификации OAuth в провайдере FAB Apache Airflow → RCE через DAG Обход аутентификации в провайдере FAB auth-manager Apache Airflow apache-airflow-providers-fab, приводящий к удалённому выполнению кода через запускаемый DAG. Провайдер декодирует Azure OAuthidtoken с...

CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...

Apache-Log4j2-RCE

Apache Log4j2 RCE Verification Environment Since from 2021.12.09 Some References https://mp.weixin.qq.com/s/yck74F9p9QhVw3ykzVoSg Setting up the Environment Maven introduces related packages and vulnerable version range root@kitploit: org.apache.logging.log4j log4j-api 2.14.1...

CVE-2026-8888-Printer-Firmware-Unsigned-Update-via-HTTP

CVE-2026-8888 – Неподписанное обновление прошивки принтера через HTTP Программный код Python HTTP-сервер + эмулятор принтера root@kitploit: !/usr/bin/env python3 printerfirmwareserver.py - Simulated printer that fetches updates over HTTP import requests, hashlib, os FIRMWAREURL =...

CVE-2026-8080-DKIM-Signature-Verification-Bypass-Header-Canonicalization-Flaw-

CVE-2026-8080 – Обход проверки подписи DKIM дефект канонизации заголовков Код программы имитация разбора электронной почты на Python root@kitploit: dkimverifiersim.py - Flawed DKIM verifier import re, hashlib Simulated email with DKIM signature rawemail = b"""From: [email protected] To:...

CVE-2026-82813

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

EUVD-2026-68720

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-72001 Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-72001

Pangolin versions prior to 1.22.0 contain an authentication bypass in the share-link endpoint. The root cause is that an attacker-controlled URL parameter can omit the expected resource identifier from the token verification call, allowing a holder of a single valid share link to authenticate aga...

CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...