Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

Version_Vulnerability_Scanner

이 저장소에는 README가 없습니다...

CVE-2024-41110-SCAN

CVE-2024-41110 Docker 보안 검사기 이 도구는 Docker 설치 환경에서 CVE-2024-41110과 관련된 취약점을 호스트에서 점검하도록 설계되었습니다. 특히 취약한 Docker 버전과 보안 문제로 이어질 수 있는 AuthZ 플러그인 사용 여부를 찾습니다. 사용법 다음 명령으로 스크립트를 실행하세요: root@kitploit: python3 scan-CVE-2024-41110.py 참고 Vladimir Poglazov 프로젝트의 요약 버전 - GitHub...

CVE-2026-70405 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-70405 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-31912 affecting package libpcap for versions less than 1.10.7-1

CVE-2026-31912 affecting package libpcap for versions less than 1.10.7-1. A patched version of the package is available...

CVE-2026-59696 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-59696 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2021-22205

CVE-2021-22205 Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 Uso: root@kitploit: Verificar vulnerabilidade: python 22205exp.py -u url -v Executar comando: python 22205exp.py -u url -c command Verificação em lote: python 22205exp.py -f filename Referência: root@kitploit:...

EUVD-2026-37013

gRPC Erlang package's path bindings are overridable by query string and request body...

CVE-2026-78270

An Author SQL Injection vulnerability affects the WordPress FluentCRM Pro plugin in versions 3.1.12 and below . Discovered by Ananda Dhakal (Patchstack), the flaw requires a high-privilege user to exploit (CVSS 7.6 HIGH , vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), yielding high confidentiality ...

Astra Linux – Vulnerability in PHP 8.1, PHP 7.3

In PHP versions starting from 8.1. up to 8.1.32, and from 8.2. up to 8.2.28, and from 8.3. up to 8.3.19, as well as in PHP versions starting from 8.4. up to 8.4.5, headers that lack a colon : are treated as valid headers, even though they are not. This can cause applications to accept invalid...

UBUNTU-CVE-2026-63385

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

CVE-2026-18938 affecting package p11-kit for versions less than 0.26.5-1

CVE-2026-18938 affecting package p11-kit for versions less than 0.26.5-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-54787 affecting package gh for versions less than 2.97.0-1

CVE-2026-54787 affecting package gh for versions less than 2.97.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-73072 affecting package vim for versions less than 9.2.0957-1

CVE-2026-73072 affecting package vim for versions less than 9.2.0957-1. An upgraded version of the package is available that resolves this issue...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099490)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099490 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26...

EUVD-2026-57740

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-13227

CVE-2026-13227 affects ERPNext prior to version 15.115.0 and prior to 16.25.0, due to improper authorization in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. The root cause is insufficient access control on this API, enabling inappropriate disclosure or manip...

CVE-2026-47746

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and...

CVE-2026-67315 axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NOPROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local...

EUVD-2026-51426

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...