D1rkSleep

D1rkSleep @5piderによるEKKOの改良版で、イメージセクションのみを暗号化します。 CreateTimerQueueTimer Win32 APIを使用するSleep難読化テクニック。 クレジット: https://github.com/Cracked5pider/Ekko...

CVE-2026-105046

Kentico Xperience 13 versions prior to 13.0.216 are vulnerable to an object-level authorization deficiency. The issue stems from a lack of proper authorization checks for administration API endpoints , which may allow unauthorized access to administrative functions. Specific details regarding the...

abusech

abusech ThreatFox はオープンな脅威インテリジェンス共有プラットフォームであり、誰でも侵害指標（IOC）を共有できます。 このリポジトリは、ThreatFox API と対話するためのコマンドラインツール（CLI）を提供します。 インストールと実行 Brew brew tap rollwagen/homebrew-tap brew install rollwagen/tap/abusech Go 直接実行する場合: go run github.com/rollwagen/abusech@latest...

gofireprox

GoFireProx これはFireProxのGolangへの移植版です インストール go install -v github.com/mr-pmillz/gofireprox/cmd/gofireprox@latest ライブラリとしてのgofireprox gofireproxを他のGoプログラムと統合する package main import "fmt" "github.com/mr-pmillz/gofireprox" func main region := "us-east-1" fpClient, err :=...

CypherDog

CypherDog4.3 PoSh BloodHound ドッグウィスパラー 別名: Neo4j HTTP API 経由で BloodHound データを操作する PowerShell コマンドレット Bloodhound 4.3+ および neo4j 4.4+ と互換性があります...

CVE-2026-97363 Monta monta.app Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access...

CVE-2026-82045

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues, which builds a JPQL query with String.format and executes it via em.createQuery without parameter binding...

CVE-2026-82043

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2026-82042

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNALKEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint...

CVE-2026-82044

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf method exposed via GET /api/generate-pdf-report. Attacke...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: k8sgpt, cert-manager-cmctl, opentofu, k9s, helm-set-status, kube-arangodb, kyverno-notation-aws, manifest-tool, rancher-helm, xeol, helm-push, kargo, helm-mapkubeapis, maru, cluster-api-helm-controller, gitness, tigera-operator, flux-helm-controller...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: k8sgpt, cert-manager-cmctl, opentofu, k9s, helm-set-status, kube-arangodb, kyverno-notation-aws, manifest-tool, rancher-helm, xeol, helm-push, kargo, helm-mapkubeapis, maru, cluster-api-helm-controller, gitness, tigera-operator, flux-helm-controller...

CVE-2026-8054

1. Vulnerability Overview CVE-2026-8054 is a high-severity pre-authentication SQL injection vulnerability Pre-auth SQL Injection in the dotCMS Core Publish Audit API. The vulnerability is officially tracked as Security Incident SI-75 and was formally disclosed at the end of May 2026. Since...

CVE-2026-103877

A flaw was found in Apache Directory LDAP API. This vulnerability allows a rogue or compromised LDAP server, or a network attacker performing a man-in-the-middle MitM attack, to execute arbitrary code on the client. During a schema search request, an attacker can return a crafted schema object...

CVE-2026-103885

A flaw was found in Apache Directory LDAP API. This vulnerability allows an attacker to cause a Denial of Service DoS by submitting specially crafted telephone numbers to an LDAP Lightweight Directory Access Protocol server using the library. Processing these malformed inputs causes indefinite CP...

CVE-2026-102731

A flaw was found in Apache Directory LDAP API. A remote unauthenticated attacker or man-in-the-middle actor can trigger this vulnerability by sending a specially crafted Basic Encoding Rules BER encoded message with an excessive size value. This causes the application to allocate an excessive...

CVE-2026-103552

A flaw was found in Apache Directory LDAP API. An unauthenticated remote attacker can cause a Denial of Service DoS by submitting a deeply nested search filter before authenticating binding with the server. Processing this filter triggers a stack overflow in the server decoder, resulting in an...

EUVD-2026-91801

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues, which builds a JPQL query with String.format and executes it via em.createQuery without parameter binding...

CVE-2026-82045 UTMStack < 11.2.16 JPQL Injection via searchPropertyValues

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues, which builds a JPQL query with String.format and executes it via em.createQuery without parameter binding...

CVE-2026-82044

Versions of UTMStack prior to 11.2.16 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the PdfService.downloadPdf() method, which fails to validate a URL parameter exposed via the GET /api/generate-pdf-report endpoint. This allows authenticated attackers to force the we...