CVE-2026-76752

Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affect...

CVE-2026-76748

A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system...

CVE-2026-103504

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

CVE-2026-103006

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

CVE-2026-102407

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

CVE-2026-101158

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

CVE-2026-102158

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

misp-extractor

MISP Extractor This code connects to a given MISP Malware Information Sharing Platform server and parses a given number of events, writing the IP addresses, URLs, and MD5 hashes found in the events to three separate files. Usage To use this script, you will need to provide the URL of your MISP...

drupalgeddon2-cli

drupalgeddon2-cli Командная строка для перезаписи доказательства концепции Drupalgeddon2 CVE-2018-7600 , создана в качестве учебного упражнения при прохождении модуля Hack The Box Academy Attacking Common Applications. !WARNING Только для авторизованного тестирования безопасности и обучения. Запу...

tracehound

Tampon de sécurité d'exécution déterministe pour les API à haute vélocité Les systèmes externes signalent les menaces. Tracehound préserve les preuves. Site Web · Index de la documentation · Référence API · Configuration · RFCs · Sécurité · Journal des modifications Tracehound est un runtime...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

py-amsi

py-amsi py-amsi est une bibliothèque qui analyse des chaînes de caractères ou des fichiers à la recherche de logiciels malveillants en utilisant l'API Windows Antimalware Scan Interface AMSI. AMSI est une interface native de Windows qui permet aux applications de demander à l'antivirus installé s...

bt2

bt2: Blaze Telegram Backdoor Toolkit bt2 est une porte dérobée basée sur Python sous la forme d'un bot de messagerie instantanée qui utilise l'infrastructure et l'API bot riche en fonctionnalités fournies par Telegram, en réutilisant légèrement sa plateforme de communication comme C&C. Dépendance...

CVE-2026-102158 Security Advisory 0190

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

EUVD-2026-93955

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2026-102158

Improper validation of selected CloudVision CUE application programming interface (API) request parameters allows an authenticated network user to perform SQL injection against the backend. This vulnerability impacts the availability of the system. No specific details regarding affected versions ...

CVE-2026-102158 Security Advisory 0190

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2018-7691

CVE-2018-7691 REST API SSC содержит уязвимости небезопасной прямой ссылки на объект Insecure Direct Object Reference, IDOR, которые позволяют аутентифицированным пользователям получать доступ к произвольным сведениям о локальных пользователях и пользователях LDAP через метод POST, а также к...

CVE-2026-101158 Security Advisory 0185

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

EUVD-2026-93944

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...