EUVD-2026-96995

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...

sniffles

Sniffles--Generador de Capturas de Paquetes para IDS y Evaluación de Expresiones Regulares Sniffles es una herramienta para crear capturas de paquetes que probarán IDS que usan patrones fijos o expresiones regulares para detectar comportamientos sospechosos. Sniffles funciona de manera muy simple...

Hacking-Vulnerability-CVE-2020-1938-Ghostcat

Hacking-Vulnerability-case-study-presentations-...

git_rce

Remote Code Execution Attack via git clone CVE-2024-32002 Contributors 이정우@Roronoawjd Background This vulnerability is a Remote Code Execution RCE vulnerability that occurs when cloning a git repository containing submodules on case-insensitive file systems such as Windows and macOS. RCE is a...

CVE-2026-89012

CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass Exploit for CVE-2026-89012: the forbidden-fields denylist in forgeSQLFromUniversalSearchCriteria introduced with the CVE-2026-71510 fix uses a case-sensitive inarray while the operand charset allows A-Z. Since SQL column resolution is...

TJ-OSINT-Notebook

TJ-OSINT-Notebook Intial Release November 18th 2022 Main Purpose: This OSINT Notebook provides an overview of the tools, techniques, and resources that I use for a variety of situations for performing reconaissance and OSINT operations. This Notebook has helped me in many situations to learn more...

Hundred OSINT

h-osint h-osint A local-first, keyboard-driven OSINT workbench for the terminal — Neovim-style keybinds, Lua config, 12 themes, and a local SQLite case store. No account, no cloud backend, no telemetry. kitty » h-osint Repository: h-osint · Binary: h-osint · Website:...

CVE-2026-9086-poc

CVE-2026-9086: Keycloak URI Scheme Validation Bypass XSS PoC 日本語版 Overview This repository contains a Proof of Concept PoC for CVE-2026-9086 , a Cross-Site Scripting XSS vulnerability in Keycloak client URI validation. Vulnerable Keycloak versions compared the prohibited javascript: and data:...

OsintCase

OSINTCase Based onOSINTMapper by Geistnigma. This project is a modified and extended version of OSINTMapper with additional features and changes focused on investigation case management, intelligence analysis and evidence handling. A browser-based OSINT investigation and case mapping tool. Organi...

gitls

Enumerate git repository URL from list of URL / User / Org. Friendly to pipeline This tool is available when the repository, such as github, is included in the bugbounty scope. Sometimes specified as an org name or user name rather than a specific repository, you can use this tool to extract url...

CVE-2026-105570

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...

CVE-2026-105570 Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...

CVE-2026-105570

Docker Sandboxes are vulnerable to a security bypass where OAuth response masking can be circumvented using a case-variant token host . The root cause is a discrepancy in case sensitivity handling: the system compares OAuth token-endpoint hostnames case-sensitvely for masking decisions, but reque...

CVE-2026-107336 Authentication Bypass by Spoofing in Malcolm

Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase for example /IDDASH2ARK/... enters the location the matcher fires but evades the rewrite n...

CVE-2026-107336

The Malcolm front nginx reverse proxy contains an authentication bypass vulnerability. A

CVE-2024-32002

Poc for CVE-2024-32002, the script made from the developer's test case: https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991ddiff-2ba261bbd9de8e881d700e696eebab0df581473ba50b671b2cbe4bbee5ca87b0 This software has been created purely for the purposes of academic research and f...

CVE-2024-50379-POC

Explotación y POC de CVE-2024-50379 Este repositorio contiene una Prueba de Concepto POC para CVE-2024-50379 , una vulnerabilidad que afecta a Apache Tomcat. El problema implica una condición de carrera de Tiempo de Verificación Tiempo de Uso TOCTOU , que puede llevar a Ejecución Remota de Código...

EUVD-2026-92446

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution...

CVE-2026-103059

A flaw was found in Gitea. When the built-in Secure Shell SSH server is enabled, public keys are evaluated using a case-insensitive comparison on certain database systems. A remote attacker who constructs a case variant of an existing user's registered public key and possesses the corresponding...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...