Kate (Product): news timeline & CVEs

Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?

Metasploit 6.5.5 adds modules for in-the-wild GitLab file read, IPv6 DNS takeover, and Langflow RCE.

Rapid7's Metasploit wrap-up for Framework 6.5.5 highlights an unauthenticated GitLab arbitrary file read, CVE-2026-85706, which the team says is exploited in the wild. It affects GitLab CE and EE from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. New auxiliary modules implement mitm6-style DHCPv6 and IPv6 router-advertisement DNS takeover (CVE-2026-20929) for Kerberos relay against Windows. An exploit module targets authenticated RCE in Langflow 1.11.1 and earlier via custom components (CVE-2026-18729), plus a Kate plugin persistence module.

Rapid7 BlogSep 25, 14:38 UTC · 1d agoTools in the wildCVE-2026-85706 CVE-2026-20929 CVE-2026-18729

Update modules/exploits/multi/persistence/kate_plugin.rb

Metasploit updated its Kate editor plugin persistence module in a commit co-authored by Diego Ledda.

A Rapid7 Metasploit Framework commit updates modules/exploits/multi/persistence/kate_plugin.rb. The message, co-authored by Diego Ledda, includes no CVE, vulnerability details, or description of the code change.

Metasploit Framework commitsSep 19, 14:33 UTC · 7d agoTools 5 sources

Update modules/exploits/multi/persistence/kate_plugin.rb

Another Metasploit commit updates the same Kate plugin persistence module with no added details.

A second Metasploit Framework commit, with a different hash, also updates modules/exploits/multi/persistence/kate_plugin.rb. As with the companion change, the public text only names the file and lists Diego Ledda as co-author. It does not describe a flaw, assign a CVE, or report observed exploitation. Treat it as routine exploit-module maintenance in the framework.

Metasploit Framework commitsSep 19, 14:33 UTC · 7d agoTools 5 sources

Update modules/exploits/multi/persistence/kate_plugin.rb

Metasploit commit updates the Kate editor plugin persistence module without new vulnerability details.

A Metasploit Framework commit updates modules/exploits/multi/persistence/kate_plugin.rb, a persistence module aimed at the Kate editor plugin mechanism. The commit message gives no vulnerability details, CVE, affected versions, or statement that the technique is being exploited. Diego Ledda is listed as a co-author. This is a framework-module maintenance change rather than a new exploitation report.

Metasploit Framework commitsSep 19, 14:33 UTC · 7d agoTools 5 sources

Update modules/exploits/multi/persistence/kate_plugin.rb

Metasploit recorded another update to the Kate plugin persistence module without publishing exploit details.

A third Rapid7 Metasploit Framework commit again updates modules/exploits/multi/persistence/kate_plugin.rb. The note only credits co-author Diego Ledda and does not describe exploit behavior or a vulnerability.

Metasploit Framework commitsSep 19, 14:33 UTC · 7d agoTools 5 sources

Update modules/exploits/multi/persistence/kate_plugin.rb

A second Metasploit commit updates the Kate plugin persistence module, with no technical details disclosed.

Another Rapid7 Metasploit Framework commit updates modules/exploits/multi/persistence/kate_plugin.rb. Co-authored by Diego Ledda, the commit message gives no technical details, CVE, or indication of in-the-wild use.

Metasploit Framework commitsSep 19, 14:33 UTC · 7d agoTools 5 sources

Kate

Timeline6 articles

Related CVEsby mentions

Appears with

Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?

Update modules/exploits/multi/persistence/kate_plugin.rb

Update modules/exploits/multi/persistence/kate_plugin.rb

Update modules/exploits/multi/persistence/kate_plugin.rb

Update modules/exploits/multi/persistence/kate_plugin.rb

Update modules/exploits/multi/persistence/kate_plugin.rb