objection

📱objection - Runtime Mobile Exploration objection is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak. Supports both iOS and Android. Inspect and interact with container file systems...

Damn-Vulnerable-Bank

Damn Vulnerable Bank Guide: https://rewanthtammana.com/damn-vulnerable-bank/ About application Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. All the details are documented in the guide, here. Upcoming Sessions NoNameCon...

chameleon

19 Customizable honeypots for monitoring network traffic, bots activities, and username\password credentials DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres, MySQL, MSSQL, Elastic and ldap If you want to implement the honeypots in your project,...

CVE-2026-100681

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...

CVE-2026-100681

Budibase versions prior to 3.45.0 are vulnerable to an unauthenticated server-side request forgery (SSRF) and credential exfiltration flaw within the Microsoft Teams webhook endpoint . The root cause is the acceptance of forged Bot Framework activities containing arbitrary serviceUrl values. An a...

CVE-2026-52825: Improper Authorization

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

PT-2026-88586

Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. Chromium security severity: Medium...

CVE-2026-84807: Incorrect Privilege Assignment

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

CVE-2026-54740: Missing Authorization

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

CVE-2026-54742: Incorrect Authorization

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction...

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

EUVD-2026-57959

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176

CVE-2026-28176 involves the WordPress Booking Activities plugin (

CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin Booking Activities versions = 1.18.4...

PT-2026-71525

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2024-27253: Improper Authentication

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities...

CVE-2026-17541 Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...