CVE-2026-37009

A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...

BrokenHill

Broken Hill documentation Table of contents 1. Prerequisites 2. Setup 3. Use 4. Options you will probably want to use frequently 5. Examples 6. Observations and recommendations 7. Extracting result information 8. Notes on specific models Broken Hill has been tested against 9. Troubleshooting 10...

forticrack

FortiCrack Verschlüsselte Fortinet-FortiOS-Firmware-Images entschlüsseln Entwickelt von Bishop Fox Team X Anforderungen Dieses Tool ist für die Ausführung in einer Linux-Umgebung vorgesehen. Installieren Sie die Pakete python3 und gzip für Ihr System. Verwendung Laden Sie ein verschlüsseltes...

CVE-2026-81834 RooCodeInc Roo-Code README File ExecaTerminalProcess code injection

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to th...

CVE-2026-81834

A code injection vulnerability exists in RooCodeInc Roo-Code (versions up to 3.51.1 ), specifically in the ExecaTerminalProcess function within the README File Handler component. The flaw allows remote attackers to inject code by manipulating this function. A public proof-of-concept exploit is av...

EUVD-2026-67231

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to th...

sudowp-hooks-visualizer

SudoWP Hooks Visualizer Mitwirkende: SudoWP, WP Republic Ursprüngliche Autoren: Stuart O'Brien, cxThemes Schlagwörter: hooks, actions, filters, developer-tool, debug, security-fork, cve-2024-6297 Erfordert mindestens: 5.8 Getestet bis: 6.7 Stabile Version: 1.3.2 Lizenz: GPLv2 oder höher...

buffalo

Buffalo Uno script Python 3 per eseguire attacchi dizionario/wordlist su un server SSH target utilizzando due file di testo come input. Scritto ai fini del mio technical screening Intel. Installazione Questo script dipende da Paramiko e Colorama. Installa le dipendenze tramite pip install -r...

notepadpp-supply-chain-iocs

Notepad++ Supply-Chain-Angriff — IoC-Repository CVE-2025-15556 | Lotus Blossom / Raspberry Typhoon | Juni – Dezember 2025 Überblick Dieses Repository enthält eine umfassende, konsolidierte Sammlung von Indikatoren für Kompromittierung IoCs im Zusammenhang mit dem Notepad++-Supply-Chain-Angriff ,...

AWS-Tough-Library-Multiple-CVEs

AWS Tough लाइब्रेरी में कई CVE मार्च 2025 में, AWS Labs के Tough लाइब्रेरी TUF – द अपडेट फ्रेमवर्क का Rust क्लाइंट इम्प्लीमेंटेशन में कई सुरक्षा कमजोरियों का खुलासा हुआ। ये मुद्दे CVE-2025-2885, CVE-2025-2886, CVE-2025-2887 और CVE-2025-2888 के अंतर्गत ट्रैक किए गए हैं, और इन्हें Tough संस्करण...

CVE-2021-33690

CVE-2021-33690 CVE-2021-33690 Vulnerabilità Server Side Request Forgery in SAP NetWeaver Development Infrastructure root@kitploit: Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver Development Infrastructure Component Build Service versions – 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

modsecurity-cve-2018-6389

modsecurity-cve-2018-6389 Ein ModSecurity-Regelsatz zur Erkennung potenzieller Angriffe mit CVE-2018-6389. Weitere Informationen finden Sie unter https://www.rastating.com/protecting-wordpress-against-cve-2018-6389/...

EUVD-2026-67195

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-59276

Spring Security is affected by a timing attack vulnerability in several components that compare security-sensitive values using standard String.equals() instead of a constant-time comparison. Because String.equals() returns as soon as a differing character is found, the response time for rejectin...

CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

EUVD-2026-67168

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub...

CVE-2026-81827

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81099

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...