apicheck

APICheck - مجموعة أدوات DevSecOps لاختبار REST APIs .. image:: https://img.shields.io/badge/License-Apache%202.0-blue.svg :target: https://github.com/BBVA/apicheck/blob/master/LICENSE :alt: License .. image:: https://readthedocs.org/projects/apicheck/badge/?version=latest :target:...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC استغلال RCE لواجهات النسخ الاحتياطي/الاستعادة في Apache Solr CVE-2023-50386 المراجع تحية إلى الخبراء: مدونة مؤلف ثغرة CVE-2023-50386 طريقة تجاوز Java Security Manager تجاوز حماية الانعكاس في JDK 17 تجاوز RASP عبر JNI مبدأ الاستغلال والتفكير:...

sysflow

SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...

EUVD-2026-67324

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

EUVD-2026-67076

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in its model-artifact APIs. The root cause is that TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs bypass pathsec enforcement by performing raw file operations on caller-controlled paths, allowing attack...

CVE-2026-81726 NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

CVE-2025-46818

CVE-2025-46818 – Redis Lua-Sandbox-Cross-User-Escape Sandbox-Escape über veraltete Lua-APIs und veränderbare Metatables auf Redis 8.2.1. Überblick Redis 8.2.1 hält veraltete Lua-Builtins getfenv, setfenv, newproxy für Skripte verfügbar und versäumt es, Metatables für Basistypen zu sperren. Ein...

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

Vanna - SQL injection

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

CVE-2025-64513

CVE-2025-64513 – Preuve de concept de contournement d'authentification du proxy Milvus 📘 Aperçu Ce dépôt contient un script de preuve de concept PoC pour vérifier l'existence de CVE-2025-64513 , une vulnérabilité critique de contournement d'authentification dans Milvus Proxy qui pourrait permettr...

zdr

Нулевое удержание данных ZDR для LLM-провайдеров Последнее обновление: Апрель 2026 года Практическое руководство по сохранению конфиденциальности ваших данных при использовании LLM API. Охватывает точки без сохранения данных, самостоятельное развертывание, требования соответствия и шаблоны защиты...

proposal-symbol-proto

Mitigazione della Prototype Pollution / Symbol.proto Autori : Santiago Díaz Google Champion : Shu-yu Guo Google Stage : 1 TOC Descrizione del problema Azione spettrale a distanza Attacchi basati solo sui dati Problemi con freeze, seal e preventExtensions L'errore di override Granularità grossolan...

EUVD-2026-66815

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-75419

go-wind-cms (GoWind) before 1.0.0 suffers from a missing authorization flaw. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), causing the authz middleware to always allow requests...

CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

noir

Caccia ogni endpoint nel tuo codice, scopri le Shadow API, mappa la superficie d'attacco. Documentazione • Installazione • Utilizzo • Contribuisci • Changelog Noir è uno strumento SAST che legge il codice sorgente ed estrae gli endpoint esposti da un'applicazione — percorsi, metodi, parametri,...

loupe

Loupe Loupe è un'app per iOS e iPadOS che ti offre una panoramica pratica della superficie di fingerprinting del dispositivo. Legge valori reali dalle API pubbliche di iOS, le stesse che qualsiasi app di terze parti può chiamare, e te li mostra in forma grezza. L'obiettivo è semplice: vedere cosa...