dnspeep

dnspeep dnspeep te permite espiar las consultas DNS que tu computadora está realizando. Aquí hay un ejemplo de salida: $ sudo dnspeep query name server IP response A incoming.telemetry.mozilla.org 192.168.1.1 CNAME: telemetry-incoming.r53-2.services.mozilla.com, CNAME:...

CVE-2026-108627

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the loadDatarule handler of the SysRoleController component. This flaw allows any authenticated user to perform unauthorized queries via the GET /sys/role/datarule/{permissionId}/{roleId} endpoint. A l...

cq

cq Code Query, uno strumento universale di scansione della sicurezza del codice. CQ esegue la scansione del codice alla ricerca di vulnerabilità di sicurezza e altri elementi di interesse per i revisori del codice focalizzati sulla sicurezza. Genera file di testo contenenti riferimenti ai problem...

Resource Exhaustion

code.vikunja.io/api is vulnerable to a resource exhaustion. The vulnerability is due to the lack of recursion depth limits for deeply nested filter expressions in the task-filter endpoint, which allows an authenticated attacker to submit thousands of nested parentheses in the filter query...

cypherhound

CypherHound Un'applicazione terminale Python3 che contiene cypher Neo4j per i set di dati di BloodHound con uno script per automatizzare l'importazione in BloodHound CE. Esempi di Output Terminale Report HTML Report HTML continua Perché? BloodHound è uno strumento fondamentale per ogni penetratio...

PT-2026-109888

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the loadDatarule handler of the SysRoleController. This issue allows any authenticated user, including those with low privileges, to query role data rules. By sendin...

PT-2026-109749

Name of the Vulnerable Software and Affected Versions Tabularis versions prior to 0.27.1 Description An incorrect authorization issue exists in the MCP run query safety gate. This allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT...

EUVD-2026-78654

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts...

MAL-2026-17387 Malicious code in arsya-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

Malicious code in bungoma (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-107825 OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERYSTRING, ARGSGET, ARGSGETNAMES, and the GET-derived portion ...

CVE-2026-107825 OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERYSTRING, ARGSGET, ARGSGETNAMES, and the GET-derived portion ...

CVE-2026-107825

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERYSTRING, ARGSGET, ARGSGETNAMES, and the GET-derived portion ...

MAL-2026-17348 Malicious code in @bellaxchuu/teambails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

GHSA-PVGV-GCP7-V38G Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Vulnerability Summary nginx-ui's Node.Secret is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a URL query parameter ?nodesecret=, causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs,...

EUVD-2026-95882

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-107807

The Nginx UI web interface (versions 2.0.0 through 2.5.0 ) is vulnerable to Node Secret Credential Exposure because it accepts the Node.Secret master credential via the node_secret URL query parameter. This occurs instead of requiring the X-Node-Secret header, potentially exposing the secret in a...

CVE-2026-86463

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

CVE-2026-86463

The Apache CXF FIQL query parser contains a vulnerability where the search pattern for operators can become stuck when processing long strings without an operator. This flaw causes the parser to consume excessive CPU time , potentially leading to a Denial of Service (DoS) or significant performan...