hardcidr

hardCIDR Background A Linux Bash script to discover the netblocks, or ranges, in CIDR notation owned by the target organization during the intelligence gathering phase of a penetration test. This information is maintained by the five Regional Internet Registries RIRs: ARIN North America RIPE...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

CVE-2026-121965 Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clien...

CVE-2026-121965 Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clien...

CVE-2026-121965

The Parse Server software versions before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 are vulnerable to a prototype pollution vulnerability (CWE-1321). This occurs when the server builds objects for Cloud Code triggers and LiveQuery using a dot notation key where an intermediate segment resolves thro...

nodesub

NODESUB Nodesub is a command-line tool for finding subdomains in bug bounty programs. It supports various subdomain enumeration techniques and provides flexible options for customization. Features Perform subdomain enumeration using CIDR notation Support input list. Perform subdomain enumeration...

CVE-2026-121415

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

CVE-2026-121414

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

CVE-2026-121415

Parse Server versions before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 using MongoDB are vulnerable to field corruption. The root cause is that the server skips field type validation for null-valued dot notation keys , which allows an attacker to write sub-documents beneath existing Pointer, Number...

CVE-2026-121415 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

EUVD-2026-115947

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

CVE-2026-121414 Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

EUVD-2026-115946

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

CVE-2026-121415: parse-community parse-server: Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot…

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

heartbleedscanner

Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...

CVE-2026-61845

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting specially crafted Cascading Style Sheets CSS inputs containing scientific notation with excessively large exponents. Because crass calculates these exponent values without proper limits, processing the...

CVE-2026-61845

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS...

EUVD-2026-114321

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS...

CVE-2026-61845 Crass: Large numeric exponents cause CPU and memory denial of service

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS...

CVE-2026-61845

The Crass Ruby CSS parser is vulnerable to a Denial of Service (DoS) condition in versions prior to 1.0.7 . The root cause is that the parser converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. An attacker providing a malicious CS...