EUVD-2026-85734

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

EUVD-2026-85707

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

EUVD-2026-85713

A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. This vulnerability affects unknown code of the file Mificonfig.bin of the component Configuration Backup Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been releas...

EUVD-2026-85705

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts...

EUVD-2026-85708

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

The vulnerability of the Serial Wire Debug interface (SWD) in the highly integrated wireless system on chip (SoC) Realtek RTL8762C allows a hacker to circumvent existing security restrictions and expose sensitive information.

The vulnerability of the Serial Wire Debug SWD interface in the highly integrated wireless system on chip SoC Realtek RTL8762C is related to improper protection against voltage and clock failures. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and...

CVE-2020-1958

CVE-2020-1958 PoC CVE-2020-1958 is high severity LDAP injection vulnerability in Apache Druid 0.17.0. It allows an attacker to bypass LDAP search filter and to retrieve any LDAP attribute values of users that exist on the LDAP server. From official Apache Druid advisory: When LDAP authentication ...

graphql-cop

GraphQL Cop - Utilidad de Auditoría de Seguridad para GraphQL Acerca de GraphQL Cop es una pequeña utilidad de Python para ejecutar pruebas de seguridad comunes contra APIs de GraphQL. GraphQL Cop es perfecto para ejecutar verificaciones CI/CD en GraphQL. Es ligero y cubre problemas de seguridad...

DotGit

DotGit Una extensión para comprobar si .git está expuesto en sitios web visitados Características Comprueba si existe una carpeta .git/.svn/.hg en cada sitio que visitas Comprueba si existe un archivo .env en cada sitio que visitas Comprueba si existe un archivo .DSStore en cada sitio que visitas...

cve-2021-38314

cve-2021-38314 - Unauthenticated Sensitive Information Disclosure The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a giv...

CVE-2025-27817

Disclaimer: The vulnerabilities and reproduction steps described in this document are for cybersecurity research and educational purposes only. No one may use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no liability for any...

CVE-2024-29296

CVE-2024-29296 - User enumeration on Portainer CE - 2.19.4 A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or...

GooFuzz

GooFuzz - El poder de los Google Dorks Créditos Autor: M3n0sD0n4ld Twitter: @DavidUton Descripción: GooFuzz es un script escrito en Bash Scripting que utiliza técnicas avanzadas de búsqueda en Google para obtener información sensible en archivos o directorios sin realizar solicitudes al servidor...

CVE-2022-23779

CVE-2022-23779: Internal Hostname Disclosure Vulnerability Information Description: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. Versions Affected: 10.1.2137.7...

CVE-2026-75886

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

cve-2022-44268

CVE-2022-44268 Credit to the researchers who discovered this: Bryan Gonzalez and the Ocelot Team Create a malicious PNG to take advantage of ImageMagick 7.1.0-40: CVE-2022-44267: Denial of Service CVE-2022-44268: Information Disclosure Disclaimer: The author of this project is not responsible for...

djangohunter

Djangohunter Herramienta diseñada para ayudar a identificar aplicaciones Django mal configuradas que están exponiendo información sensible. https://www.reddit.com/r/django/comments/87qcf4/28165thousanddjangorunningserversareexposed/ https://twitter.com/6ix7ine/status/978598496658960384?lang=en Us...

CVE-2026-84717

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

CVE-2026-84720

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestorartifacts database column, which stores the raw merged setstats artifacts propagated between workflow nodes, is not wrapped in preventsearch and is therefore accepted for arbitrary field lookups...

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...