EUVD-2026-94524

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...

CVE-2026-62253

The Homer telecom observability software is vulnerable to a complete authentication bypass in versions prior to 11.0.283 . The root cause is that both JWTMiddleware and JWTMiddlewareV4 functions (located in coordinator/handlers/auth.go and coordinator/handlers/auth_v4_helpers.go) are designed to ...

CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...

EUVD-2026-94522

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

Exchange2domain

Exchange2domain Outil tout-en-un de privexchange. Vous avez seulement besoin d'ouvrir le port du serveur web, donc aucun privilège élevé n'est requis. Excellent article ! Abusing Exchange: One API call away from Domain Admin. Prérequis Ces outils nécessitent impacket. Vous pouvez l'installer avec...

EUVD-2026-94521

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

Cisco License (Smart Software Manager) On-Prem Vulnerabilities

Multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow a remote attacker to gain unauthorized access, access sensitive information, cause a denial of service DoS condition, o...

Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

dnsFookup

DnsFookup v 2.0.1 DNS Rebinding freamwork containing: a dns server obviously python web api to create new subdomains and control the dns server, view logs, stuff like that shitty react app to make it more comfy Changelog API documentation What does it do? It lets you create dns bins like a burp...

CVE-2026-107273

Gophish versions 0.11.0 through 0.12.1 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability via the POST /api/import/site endpoint. This flaw allows authenticated low-privileged users to submit internal URLs that the default dialer deny list fails to block. Successful exploitation...

CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

EUVD-2026-94404

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

CVE-2026-107272 Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107272

Gophish versions through 0.12.1 are vulnerable to stored and reflected cross-site scripting (XSS) due to unescaped SMTP server error messages . An attacker who controls or intercepts a sending profile's SMTP server can inject malicious scripts. These scripts execute when administrators view campa...

EUVD-2026-94403

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107272 Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...