122031 matches found
shannon v2.5.0
!NOTE Shannon 2.0 is officially here Shannon - AI Pentester by Keygraph Shannon is an autonomous, AI pentester for web applications and APIs. It analyzes your source code, identifies attack paths, and executes real exploits to prove vulnerabilities before they reach production. This repository is...
CVE-2026-67271
creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtesubdz2n2e 2026-08-18 19:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtevmlmdrv2m 2026-08-20 14:04:51+00:00| seen|...
CVE-2026-55106
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
EUVD-2026-61062
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...
EUVD-2026-61061
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
CVE-2026-55106
authentik's LDAP Source API diagnostic action bypasses object-level read-authorization, letting unauthenticated clients trigger upstream LDAP queries using the source's bind credentials. The response exposes DNs and attribute names (not values), revealing directory structure, naming conventions, ...
CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
CVE-2026-55106
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
CVE-2026-32444
creationtimestamp| type| source ---|---|--- 2026-08-18 15:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtekysxdfw25 2026-08-18 16:08:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtelz3yfma25...
CVE-2026-50252
A flaw in Unbound's SOREUSEPORT implementation reduces UDP source port entropy by allowing attackers to map ports to specific worker threads. This enables DNS cache poisoning, potentially leading to traffic redirection or unauthorized information disclosure. Mitigation Disable the so-reuseport...
CVE-2026-50187
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...
CVE-2026-50187 Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...
MINI-5J7M-R2F9-3RWV
Bulletin has no description...
CVE-2026-67919
creationtimestamp| type| source ---|---|--- 2026-08-18 13:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtebistfd32e 2026-08-20 03:00:04+00:00| published-proof-of-concept| Telegram/OEj0lkcuhy0tneu4LVEJjjSEMhrw6Me4lFPRcwL7UUOA 2026-08-20 03:00:04+00:00|...
CVE-2026-45532
DataEase versions prior to 2.10.23 on Windows have a path traversal flaw: the server only filters /, allowing attackers to traverse directories via \. The fix is in v2.10.23; no workarounds exist. CVSS 4.0 scores 8.7 (HIGH) with network access and no authentication required. No exploitation detai...
GHSA-VV82-QVPF-RJWV
creationtimestamp| type| source ---|---|--- 2026-08-18 12:39:35+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mteae5u7gz26...
CVE-2026-75837
creationtimestamp| type| source ---|---|--- 2026-08-18 12:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mte6petjve2t 2026-08-18 14:08:10+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtefck2d542b 2026-09-17 22:32:09+00:00| seen|...
nightingale v9.1.1
Open-Source Alerting Expert English | δΈζ π― What is Nightingale Nightingale is an open-source monitoring project that focuses on alerting. Similar to Grafana, Nightingale also connects with various existing data sources. However, while Grafana emphasizes visualization, Nightingale places greater...