CVE-2026-70652

A flaw was found in libvips, an image processing library. When libvips is built with libultrahdr support, it can incorrectly size an output buffer during the process of enlarging an incoming JPEG to a very large output before encoding a gain map. This undersized allocation can lead to a heap buff...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CVE-2026-23111

🐧 CVE-2026-23111 - 리눅스 커널 nftables 사용 후 해제 취약점 ⚠️ 리눅스 커널 nftables의 사용 후 해제 📖 개요 CVE-2026-23111 은 리눅스 커널의 netfilter/nftables 서브시스템에 영향을 미치는 높은 심각도의 사용 후 해제UAF 취약점입니다. 이 결함은 nftables 트랜잭션 롤백 작업 중 catch-all 맵 요소의 잘못된 처리로 인해 발생하며, 이로 인해 로컬 공격자가 커널 메모리 손상을 트리거할 수 있는 메모리 안전 문제가 발생합니다. 🎯 취약점 정보 🔬 기술 분석...

CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly...

Linux Distros Unpatched Vulnerability : CVE-2026-80675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map-sha against the metadata hash in its instructions. map-sha is calculated...

Nextjs_RCE_Exploit_Tool

Next.js RCE Exploit Tool CVE-2025-55182 !CAUTION 면책 조항 / Disclaimer 본 도구는 보안 연구 및 교육 목적으로만 사용하십시오. 사용자는 본 도구를 사용하여 테스트를 수행할 때 반드시 대상 시스템에 대한 합법적인 승인 을 획득해야 합니다. 무단 침투 테스트, 악의적인 공격 또는 기타 불법적인 용도로의 사용을 엄격히 금지합니다. 취약점을 인지하고 악용함으로써 발생하는 모든 위험과 법적 책임은 사용자 본인 에게 있으며, 본 프로젝트 개발자와는 무관합니다. 본 조항에 동의하지 않는 경...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

CVE-2026-8732

CVE-2026-8732 - WordPress WP Google Map Pro 대량 스캐너 및 자동 관리자 생성기 📌 설명 이 도구는 WordPress용 WP Google Map Pro 플러그인의 취약점인 CVE-2026-8732 를 악용합니다. 이 취약점은 인증되지 않은 공격자가 AJAX 엔드포인트admin-ajax.php?action=wpgmptempaccessajax를 통해 유효한 wpmptoken을 획득할 수 있게 합니다. 이 토큰을 사용하여 공격자는 WordPress 관리자 패널에 접근하고 새로운 관리자 사용자를 생성...

GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

CVE-2026-75847

Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version...

CVE-2026-75847 Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version...

CVE-2026-75847 Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version...

CVE-2026-75847

ash_paper_trail (by ash-project) is an Elixir audit/versioning library. The changes map in the generated version resource is declared public? true and sensitive? false because AshPaperTrail.Resource.Transformers.CreateVersionResource derives sensitivity from ignore_attributes (which defaults to e...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC di CVE-2026-52715 Proof of Concept educativa di GeoLeak CVE-2026-52715, iniezione SQL non autenticata CVSS 9.3 nel plugin GEO my WordPress = 4.5.5 per WordPress. I parametri swlatlng e nelatlng dei limiti della mappa vengono interpolati senza sanificazione nella clausola WHERE...

CVE-2026-14431

CVE-2026-14431 Correzione di bug https://chromium-review.googlesource.com/c/v8/v8/+/7950517 root@kitploit: maglev Check map of inlined array in ArrayIteratorPrototypeNext Fixed: 523884658 Change-Id: I2a2bba817952d7023eb4b97ad41d8bb460fb9359 Reviewed-on:...

PsyloDbg

PsyloDbg PsyloDbg è un debugger Windows open source in rapida crescita e facile da usare, interamente scritto in Delphi. L'obiettivo principale di questo progetto è offrire agli analisti di malware uno strumento in più per ridurre i tempi di risposta durante il processo di analisi. Il progetto è...

CVE-2026-72898

Hinweis zum Toucan2-Verhalten und map ohne :closed true...

Samba-CVE-2007-2447-Exploit-Username-Map-Script

Samba CVE-2007-2447 Exploit Username Map Script Questo repository contiene uno script Python progettato per automatizzare lo sfruttamento della vulnerabilità CVE-2007-2447 nei server Samba versioni 3.0.20 a 3.0.25rc3. Questo strumento è stato sviluppato a fini esclusivamente educativi e per test ...

aiagent-detection-rules

aiagent-detection-rules Sigma-, Splunk-, Elastic- und YARA-Erkennungsregeln für den Claude-Code-Quellcode-Leak 31. März 2026 und den gleichzeitigen npm-Lieferkettenangriff. Am 31. März 2026 hat Anthropic versehentlich eine fehlkonfigurierte Source-Map in @anthropic-ai/[email protected]...