CVE-2024-38526

CVE-2024-38526 - Polyfill Scanner: x Mass Urls Scanner The polyfill.io CDN, previously compromised to serve malicious code, has now been secured with the latest fix in pdoc 14.5.1. Overview Detect potential issues Automate repetitive tasks with ease Features High Confidence Alerts : Detects scrip...

CVE-2026-88648

A flaw was found in GnuTLS. An attacker controlling a subordinate Certificate Authority CA can exploit an incomplete X.509 certificate validation mechanism to bypass cross-domain Public Key Infrastructure PKI restrictions. This allows unauthorized certificates to be accepted as valid, potentially...

bug-bounty-domains

BUG BOUNTY DOMAINS Domains belonging to the most reputed public bug bounty programs. NOT FOR NON-MONETARY OR PRIVATE PROGRAMS !https://assets.kitploit.com/production/public/readmes/6941/7164554a880fd0545e5dc196593b59979d6603d1462460...

class_struggle

Class Struggle Repository accompanying the "Class Struggle" article. The repository demonstrates use of an autoencoder for detecting domains similar to a known subset of phishing domains published by CERT Polska. Data Sources CERT Polska Warning List This project uses data from the CERT Polska...

destroylist

Destroylist : Liste noire de domaines de phishing et d'arnaque !Last Commithttps://img.shields.i...

CVE-2026-104048

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. setup.exe – プライバシー、ドライバー、メモリ文字列 setup.exe ドロッパーの Process Hacker メモリ分析により、Lumma Stealer がプライバシー設定を標的とし、ドライバーをインストールし、メモリを管理することが明らかになりました。 確認された主要な文字列: Privacy Camera – カメラのプライバシー設定へのアクセスまたは無効化を試みます。 Privacy Microphone – マイクのプライバシー設定へのアクセスまたは無効化を試みます。 PreinstallDriver –...

PT-2026-107129

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw exists when the migrations ALLOWED DOMAINS configuration is active. The system accepts hostnames matching the allow list without verifying if the resolved address violates local-network...

Astra Linux – Vulnerability in Linux, Linux 5.10

Rogue backends can cause Denial of Service DoS attacks on guests through high-frequency events. This CNA information record relates to multiple Common Vulnerabilities and Exposures CVEs; the text explains which aspects/vulnerabilities correspond to which CVEs. Xen allows for the execution of PV...

Astra Linux – Vulnerability in Linux, Linux 5.10

Rogue backends can cause Denial of Service DoS attacks on guests through high-frequency events. This CNA information record relates to multiple Common Vulnerabilities and Exposures CVEs; the text explains which aspects/vulnerabilities correspond to which CVEs. Xen allows for the execution of PV...

CVE-2026-104807

The Mitel MiVoice Office 400 web portal is vulnerable to a stored Cross-Site Scripting (XSS) flaw (CWE-79). The issue resides in the Configuration → Domains section, specifically within the "Description" field, where the application fails to properly validate or sanitize user-supplied input befor...

EUVD-2026-92296

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domain...

domains-from-csp

domains-from-csp CSP 헤더에서 도메인 이름을 파싱하는 Python 스크립트 Content Security PolicyCSP 헤더에서 도메인 이름을 추출하는 스크립트 현재 출력은 stdout으로 출력됩니다 데모 스크린샷 서드파티 패키지 의존성 requests click 설치 이 저장소를 클론하세요 $ git clone [email protected]:yamakira/censys-enumeration.git 의존성을 설치하세요 $ pipenv install 도움말 메뉴를 확인하세요 $ python...

ThreatIntelligenceDiscordBot

위협 인텔리전스 Discord 봇 vx-underground 위협 인텔리전스 Discord 봇은 다양한 클리어넷 도메인, 랜섬웨어 위협 행위자 도메인 및 Telegram 채널에서 업데이트를 가져옵니다. 이 봇은 1800초 간격으로 업데이트를 확인합니다Telegram 봇은 제외, 실시간으로 수신됨. 직접 설정하고 싶지 않으신가요? 이 위협 인텔리전스 봇이 지금 Discord에서 운영 중입니다. Python 3.10 64bit로 작성됨 Windows 또는 Linux에서 실행 가능 Discord Webhook 필요 모니터링하려는...

OverAct: Measuring and Mitigating Proactive Over-Authorization in LLM Tool-Calling Agents

LLM agents with tool-calling capabilities can access external services and private user data, but they may retrieve more information than a user's request explicitly requires. We study this behavior in structured tool-calling agents and term it proactive over-authorization. This setting differs...

CVE-2026-102106

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-102106

The Kiteworks Email Protection Gateway contains an improper authentication vulnerability within an administrative service. The root cause is that the service fails to consistently enforce administrator authentication, allowing a required password check to be bypassed. An attacker referencing a va...

CVE-2026-102106 Kiteworks Email Protection Gateway improper authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

MAL-2026-17339 Malicious code in reactjs-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...

CVE-2026-102106: Improper Authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...