3045 matches found
CVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware o...
CVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware o...
CVE-2026-42505
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CVE-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
EUVD-2026-42317
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CVE-2026-50529: Incorrect Authorization
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid...
PT-2026-56479
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Handshakes using Encrypted Client Hello ECH, a mechanism designed to encrypt the initial handshake of a TLS connection to protect client privacy, could be...
scripts
Guía de Estructura de Scripts — PternaSec/scripts Este reposi...
Exploit for Integer Overflow to Buffer Overflow in Libssh2
Reporte de Seguridad: CVE-2026-55200 📝 Descripción General...
Exploit for CVE-2025-40271
CVE-2025-40271 — procreaddirde rb-tree UAF LPE Proof-of-c...
CVE-2026-57341: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.9.0 versions...
web-security-auditor
Web Security Auditor Auditor automático de seguridad web desa...
Web-Attack-Investigator
Web Attack Investigator Ferramenta de investigação de ataques...
kaido-waf
⚔️ Kaido WAF Web Application Firewall do Kaido Red Team...
Soul-Collector
Windows Post-Exploitation & Credential Hunting Tool Uma ferra...
ccdd-poc
ccdd-poc — ¿Dónde está el límite de un solucionador de issues...
llmbias-tse
llmbias-tse Prova de conceito POC do projeto InternetLab...
CVE-2026-8885
The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on the 'width' and 'align' shortcode attributes...