Winstone Servlet Engine Detection

Detected servers running the Winstone Servlet Engine via the Server or X-Powered-By headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers running the Winstone Servlet Engine via the Server or X-Powered-By headers.""" import re from kittysploit import from...

X-Recruiting Header Detection

Websites that advertise jobs via HTTP headers !/usr/bin/env python3 -- coding: utf-8 -- """Websites that advertise jobs via HTTP headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'X-Recruiting Header Detection'...

X-Proxy Dashboard Panel - Detect

X-Proxy Dashboard panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """X-Proxy Dashboard panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'X-Proxy Dashboard Panel - Detect', 'description...

Spring Boot `X-Application-Context` Header Exposure Detection

Detected the presence of the X-Application-Context header in HTTP responses, which can expose sensitive application context information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of the X-Application-Context header in HTTP responses, which can expose sensitive applic."""...

x-amz-meta-s3cmd-attrs Header Username Disclosure Detection

Detected exposure of the x-amz-meta-s3cmd-attrs header in S3 objects, which can disclose sensitive information including the username uname, user ID uid, group name gname, and group ID gid of the user who uploaded the file using s3cmd. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposur...

AspNet Version Disclosure - Detect

Detects version disclosed via 'X-AspNet-Version' header. !/usr/bin/env python3 -- coding: utf-8 -- """Detects version disclosed via 'X-AspNet-Version' header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

NetAlert X Panel - Detect

NetAlert X panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """NetAlert X panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NetAlert X Panel - Detect', 'description': 'NetAlert X...

Inertia.js - Detect

Detected Inertia.js passively using a single plain GET request with no special headers. It matched four server-emitted Inertia-specific signals on the initial document: three proximity-bound body patterns covering the embedded page object formats and one Vary: X-Inertia response header signal set...

PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting Detection

PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header. !/usr/bin/env python3 -- coding: utf-8 -- """PKP Open Journal Systems 2.""" from kittysploit import from...

CVE-2026-59897

A flaw was found in Hono, a web application framework. The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values using a substring comparison, rather than an exact match. This can lead to incomplete data being received by middleware or application logic that relies o...

vulnerabilities found in Apple MacOS

Apple has addressed several vulnerabilities in MacOS, specifically in the versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.x. These vulnerabilities involve various security issues in macOS, including insufficient sandbox restrictions, which may allow applications to gain unauthorized access t...

CVE-2026-56003

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server...

USN-8615-1 linux, linux-aws, linux-aws-5.4, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-iot, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8615-1: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

CVE-2026-55415: Improper Control of Generation of Code

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...

PT-2026-65659

Summary datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial...

PT-2026-65642

Summary A malicious input schema OpenAPI / JSON Schema can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in th...

CVE-2026-54655: Improper Control of Generation of Code

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

Malicious Package

Overview @nolimit-x/win32-x64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

AZL-94202 CVE-2026-59251 affecting package erlang for versions less than 26.2.5.21-4

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...