subcrawl

SubCrawl SubCrawl is a framework developed by Patrick Schläpfer, Josh Stroschein and Alex Holland of HP Inc’s Threat Research team. SubCrawl is designed to find, scan and analyze open directories. The framework is modular, consisting of four components: input modules, processing modules, output...

CVE-2018-12597

CVE-2018-12597 CVE-2018-12597 タイムライン ================ 2018-06-08: 発見 2018-06-11: ステージング環境で再テスト 2018-06-12: 本番環境で再テスト 2018-06-19: 社内連絡 2018-06-21: ベンダーへ通知 2018-06-XX: ベンダーからのフィードバック 2018-06-XX: ベンダーからのフィードバック（製品はパッチ適用予定） 2018-06-XX: パッチ公開 2018-06-XX: CVE/アドバイザリ公開についてベンダーと合意。 2018-06-XX: 公開レポート 著者...

CVE-2018-10467

CVE-2018-10467 タイムライン 2018-04-06: 発見 2018-04-13: ステージング環境での再テスト 2018-04-16: 内部連絡 2018-04-27: ベンダー通知 2018-04-27: ベンダーフィードバック 2018-05-27: 製品の技術的明確化 2018-05-03: ベンダーからの問題修正手順の追加 2018-05-04: 公開開示（審査中）... 著者 Alex Hernandez 別名 @alt3kx...

CVE-2018-10715

CVE-2018-10715 タイムライン 2018-04-06: 発見 2018-04-13: ステージング環境の再テスト 2018-04-16: 内部連絡 2018-05-03: ベンダー通知 2018-05-03: ベンダーフィードバック 2018-05-XX: 製品の技術的明確化 2018-05-XX: ベンダーからの問題修正手順の追加 2018-05-XX: 公開開示（審査中）... 作者 Alex Hernandez 別名 @alt3kx...

CVE-2025-12399

Alex Reservations: Smart Restaurant Booking = 2.2.3 - 認証済み（Admin+）任意ファイルアップロード WordPress プラグイン Alex Reservations（バージョン 2.2.3 以前）には、認証済みの WordPress 管理者が悪意のある PHP ファイルをサーバーにアップロードできる任意ファイルアップロードの脆弱性が存在し、リモートコード実行につながる可能性があります。 TL;DR エクスプロイト リモート攻撃者が shell.php をアップロードしてリモートコードを実行することを実証するための POC...

@fancyliu/speclite (>=0.1.0, <=0.3.0), actual-moneymoney (>=3.0.0, <=3.5.0) +1 more potentially affected by CVE-2026-77465 via toml (>=4.1.1, <=4.1.2)

toml NPM version =4.1.1, =0.1.0, =3.0.0, =2.7.0, =2.12.4 Source cves: CVE-2026-77465 Source advisory: OSV:GHSA-82X6-Q7MM-W9CF...

@fancyliu/speclite (>=0.1.0, <=0.3.0), actual-moneymoney (>=3.0.0, <=3.5.0) +1 more potentially affected by CVE-2026-63376 via toml (4.1.1)

toml NPM version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @fancyliu/speclite =0.1.0, =3.0.0, =2.7.0, =2.11.3 Source cves: CVE-2026-63376 Source advisory: OSV:GHSA-V5MP-JGW5-2X6J...

sign-alex (1.0.1) potentially affected by CVE-2026-70592 via ghost (1.26.2)

ghost NPM version 1.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on ghost and may be impacted: - sign-alex 1.0.1 Source cves: CVE-2026-70592 Source advisory: OSV:GHSA-CJ62-HVV2-2Q5H...

sign-alex (1.0.1) potentially affected by CVE-2026-70592 via ghost (1.26.2)

ghost NPM version 1.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on ghost and may be impacted: - sign-alex 1.0.1 Source cves: CVE-2026-70592 Source advisory: SNYK:JS-GHOST-18612530...

ghost-blade (0.1.0), ohm (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2026-70591 via ghost (>=0.11.14, <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - sign-alex 1.0.1 Source cves: CVE-2026-70591 Source advisory: SNYK:JS-GHOST-18610058...

ghost-blade (0.1.0), ohm (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2026-70591 via ghost (>=0.11.14, <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - sign-alex 1.0.1 Source cves: CVE-2026-70591 Source advisory: OSV:GHSA-GCVV-72Q8-9V76...

DHS Demanded Google Surrender Data on Canadian’s Activity, Location Over Anti-ICE Posts

Using a 1930s trade law, Homeland Security targeted the man—who hasn’t entered the US in more than a decade—following posts on X condemning the killings of Renee Good and Alex Pretti...

WordPress Responsive Plus plugin < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Alex Tselevich nos3curity in WordPress Plugin Responsive Plus versions 3.4.3...

ghost-blade (0.1.0), ohm (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2026-29053 via ghost (>=0.11.14, <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - sign-alex 1.0.1 Source cves: CVE-2026-29053 Source advisory: OSV:GHSA-CGC2-RCRH-QR5X...

The Instant Smear Campaign Against Border Patrol Shooting Victim Alex Pretti

Within minutes of the shooting, the Trump administration and right-wing influencers began disparaging the man shot by a federal immigration officer on Saturday in Minneapolis...

CVE-2026-1070

The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing nonce validation on the alexusercounterfunction function. This makes it possible for unauthenticated attackers to update the plugin settings via...

CVE-2026-1070

The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing nonce validation on the alexusercounterfunction function. This makes it possible for unauthenticated attackers to update the plugin settings via...

CVE-2026-1070

CVE-2026-1070 refers to the WordPress plugin “Alex User Counter” (versions

CVE-2026-1070 Alex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Update

The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing nonce validation on the alexusercounterfunction function. This makes it possible for unauthenticated attackers to update the plugin settings via...

WordPress Alex User Counter plugin <= 6.0 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Alex User Counter versions = 6.0...