Awesome-FOFA

Awesome-FOFA Library 📒 中文 README Get Started with FOFA A Beginner’s Guide How to Get Free F-point from FOFA? FOFA and AI Next-Generation Attack Surface Inventory: Free Trial Available! Basic scenario How to use FOFA to discover free LLM resources? Elevating FOFA Search Efficiency through Novel...

@bymbly/api-tools (>=1.3.1, <=1.4.55), @fsco/autosync (>=0.2.12, <=0.3.1) +1 more potentially affected by CVE-2026-63225 via @redocly/cli (>=2.0.2, <=2.32.2)

@redocly/cli NPM version =2.0.2, =1.3.1, =0.2.12, =2.5.0, =3.11.1 Source cves: CVE-2026-63225 Source advisory: OSV:GHSA-657C-G7QC-R9J2...

@bymbly/api-tools (>=1.3.1, <=1.4.55), @fsco/autosync (>=0.2.12, <=0.3.1) +1 more potentially affected by CVE-2026-63225 via @redocly/cli (>=2.0.2, <=2.32.2)

@redocly/cli NPM version =2.0.2, =1.3.1, =0.2.12, =2.5.0, =3.11.1 Source cves: CVE-2026-63225 Source advisory: GHSA-657C-G7QC-R9J2...

@bymbly/api-tools (>=1.3.1, <=1.4.55), @fsco/autosync (>=0.2.12, <=0.3.1) +1 more potentially affected by CVE-2026-63225 via @redocly/cli (>=2.0.2, <=2.32.2)

@redocly/cli NPM version =2.0.2, =1.3.1, =0.2.12, =2.5.0, =3.11.1 Source cves: CVE-2026-63225 Source advisory: MEND:CVE-2026-63225...

CVE-2026-55864

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-55864

GeoNetwork is a catalog application for managing spatially referenced resources. An unauthenticated Server-Side Request Forgery (SSRF) exists in the SLD tooling endpoint POST /api/tools/ogc/sld, which accepted a caller-supplied WMS server URL and performed a server-side HTTP GET with no destinati...

CVE-2026-55864: Server-Side Request Forgery (SSRF)

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-90690

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

EUVD-2026-77215

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

CVE-2026-90690 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

CVE-2026-90690 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

CVE-2026-90690

0x4m4 HexStrike AI (up to commit d689933ff579d839c676c82b231f8e98326c5f04) is vulnerable to OS command injection in the API Tools Endpoint component. The flaw resides in the subprocess.Popen call within hexstrike_server.py, where manipulation of arguments such as additional_args, target, username...

CVE-2026-90690 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

CVE-2026-90690: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

PT-2026-91108

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrike server.py of the component API Tools Endpoint. Executing a manipulation of the argument additional...

CVE-2026-8081

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

Attacking the MCP Trust Boundary

Every secure API draws a line between code and data. HTTP separates headers from bodies. SQL has prepared statements. Even email distinguishes the envelope from the message. The Model Context Protocol MCP, the fast-growing standard for connecting AI agents to external services, inherits that gap...

WeRSS path traversal vulnerability

WeRSS is a WeChat official account system developed by Rachel. Versions of WeRSS 1.4.8 and earlier contained a path traversal vulnerability. This vulnerability stemmed from incorrect handling of the parameter filename in the downloadexportfile function within the files apis/tools.py, which could...

CVE-2025-52024

A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services,...