EUVD-2026-92788

Langflow: OS command injection RCE via arbitrary command in MCP stdio server configuration...

CVE-2026-107206

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

CVE-2026-107206

LMCache versions through 0.5.5 are vulnerable to a missing authentication flaw in the multiprocess mode HTTP server. Because management endpoints listen on all interfaces by default, remote unauthenticated attackers can access sensitive functionality. Impacted actions include reading environment ...

CVE-2026-107206 LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

mzap

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...

sparrow-wifi

Sparrow-WiFi Sparrow-WiFi is a 2.4 GHz and 5 GHz WiFi and Bluetooth spectral awareness tool for Linux. It integrates WiFi scanning, Bluetooth Low Energy and Classic discovery, software-defined radio spectrum analysis HackRF, Ubertooth, GPS tracking, FAA RemoteID drone detection, drone/rover-mount...

PyFlooder

PyFlooder 일반 웹사이트를 10초 안에 중단시킬 수 있는 HTTP Flood Python 스크립트 어떻게 작동하나요 ? 구성 가능한 수의 무작위 GET 요청을 생성하여 대상에 전송합니다. 사용법 pyflooder.py...

bonesi

BoNeSi BoNeSi , симулятор DDoS-ботнетов, — это инструмент для имитации трафика ботнетов в тестовой среде на уровне провода. Он предназначен для изучения воздействия DDoS-атак. Какой трафик можно генерировать? BoNeSi генерирует ICMP-, UDP- и TCP-атаки HTTP с использованием заданного размера ботнет...

tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

extended-xss-search

Расширенный поисковик и обнаружитель XSS Это расширенная версия на основе первоначальной идеи, уже опубликованной как "xssfinder". Данная приватная версия позволяет атакующему выполнять не только GET, но и POST запросы. Кроме того, возможно проксировать каждый запрос через Burp или другой туннель...

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

Summary The trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can embed a single tag on a malicious page; when an authenticated trainer...

sqlmc

SQLMC - SQL Injection Massive Checker Демо Информация Этот инструмент предназначен только для образовательных целей; использование SQLMC для атак на цели без предварительного взаимного согласия незаконно. Разработчики не несут ответственности и не несут ответственности за любое неправильное...

CVE-2026-45161

The wger fitness manager (prior to version 2.6 ) is vulnerable to a CSRF attack because the trainer_login view (located in wger/core/views/user.py) accepts GET requests. Since Django's CsrfViewMiddleware only enforces tokens on unsafe methods like POST, an attacker can use a malicious `

CVE-2026-105138

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-76461

cve-id 기부 이 프로젝트 유지 관리 돕기 이 프로젝트가 유용하다고 생각하신다면 PayPal 또는 ABA Mobile을 통해 지속적인 유지 관리를 지원해 주시기 바랍니다. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ 모든 기부금의 10퍼센트는 Kantha Bopha 어린이 병원에 기부됩니다. | 결제 방법 선택 ABA Mobile로 스캔 · 클릭하여 확대 ---|--- ⚡ 간단한 사용법 GitHub에서 직접 최신 버전의 외부 다운로드...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation pip install acltoolkit-ad or...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-105138

The Obot platform versions 0.12.0 before 0.26.2 is vulnerable to a credential exposure flaw in the MCP Catalog Entry API . Due to insufficiently protected credentials, authenticated basic users with access to an entry can perform a GET request to /api/all-mcps/entries/{entry_id}. This action allo...

EUVD-2026-94309

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...