CVE-2026-108264

Wizarr, a management system for media servers like Jellyfin and Plex, is vulnerable to Server-Side Template Injection (SSTI) prior to version 2026.9.1 . The issue exists because wizard step Markdown—provided via the editor or imported bundles—is evaluated in a non-sandboxed Jinja2 environment wit...

CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

Vikunja: TOTP secret is readable after enrollment, no step-up auth

Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...

CVE-2026-33272

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

EUVD-2026-95815

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

nuclei-burp-plugin

Nuclei Template Generator Burp Plugin A Burp Suite plugin intended to help with nuclei template generation. Features Template matcher generation Word and Binary matcher creation using selected response snippets from Proxy history or Repeater contexts Multi-line selections are split to separate...

systeminformer

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc...

CVE-2026-85348

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

HardeningKitty

HardeningKitty Это стабильная версия HardeningKitty из проекта Windows Hardening от Michael Schneider. Стабильная версия HardeningKitty подписана сертификатом подписи кода scip AG. Поскольку это стабильная версия, мы не принимаем pull request'ы в этом репозитории; пожалуйста, отправляйте их...

EUVD-2026-95706

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

WhatsApp-OSINT

WHATS OSINT 🕵️‍♂️ OSINT-инструмент для WhatsApp , который позволяет получать фото профиля, проверять бизнес-аккаунты, просматривать статус и информацию о пользователе, анализировать связанные устройства, изучать настройки приватности и получать полные данные с помощью WhatsApp OSINT API от...

MsSettingsDelegateExecute

MsSettingsDelegateExecute Обход UAC в Windows 10/11 x64 с использованием ключа реестра DelegateExecute в ms-settings. Этот проект Visual Studio скомпилирует статический x64-бинарный файл для проверки этой проблемы. Лицензия Эти файлы доступны по 3-пунктной лицензии BSD...

surf

Surf - Escalate your SSRF vulnerabilities on Modern Cloud Environments surf allows you to filter a list of hosts, returning a list of viable SSRF candidates. It does this by sending a HTTP request from your machine to each host, collecting all the hosts that did not respond, and then filtering th...

tachyon

Tachyon Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl a web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.6+ User Installation...

user.js

Этот репозиторий и интерактивная веб-страница по ссылке ниже являются единственными официальными источниками - не доверяйте другим сайтам, утверждающим, что они Arkenfox 🟪 user.js user.js - это конфигурационный файл, который может управлять настройками Firefox - для более технического разбора и...

CVE-2019-19651

CVE-2019-19651 Отражённая XSS в Chevereto в полях Website Name, doctitle и description - 1.0.0 - 1.1.4 Free, Настройки - Название сайта, Заголовок документа, Описание Ввод этого значения приведёт к отражению на всём сайте для всех пользователей "ChevtChevt...

EUVD-2026-95523

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

CVE-2026-88931

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to an unauthenticated arbitrary plugin settings update . The root cause is a failure to restrict which settings can be modified via an unauthenticated endpoint. This allows an attacker to overwrite arbitrary plugin opt...

CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...