118975 matches found
CVE-2026-124931: Mozilla Firefox: Same-origin policy bypass in the DOM: Core & HTML component
Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
PT-2026-141645
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...
Security Vulnerabilities fixed in Firefox 160 — Mozilla
CVE-2026-124852: Incorrect boundary conditions in the Graphics: CanvasWebGL component Reporter Mozilla Impact high References Bug 2001244 CVE-2026-124853: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component Reporter Mozilla Impact high References Bug 2058035...
nmap-bootstrap-xsl
nmap-bootstrap-xsl Have a nice interface for checking the result of your Nmap scans. This software must not be used by military or secret service organisations. How to use 1. New Nmap scan Add the nmap-bootstrap.xsl as stylesheet to your Nmap scan with the --stylesheet argument : nmap -sS -T4 -A...
CVE-2026-125357 Munin munin-httpd through 2.999.18 Path Traversal via Static File Handler
Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring che...
CVE-2026-125357
The Munin munin-httpd server versions 2.99.1 through 2.999.18 are susceptible to a path traversal vulnerability in the Munin::Master::HTML::handle_request static file handler. This flaw allows unauthenticated attackers to bypass the /../ substring check by requesting /static/../. Successful explo...
cloudsplaining
Cloudsplaining Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report. Example report Documentation For full documentation, please visit the project on ReadTheDocs. Installation Cheatsheet Example report...
AdvPhishing
Check For Mp4: https://www.instagram.com/tukbuck/reel/DTBBBknj-nd/ Note: If you want to activate this tool or want same project with working condition then first pay: ETHERC20 wallet address: 0xe48df3c0e1713518096c7d2d0a2dce70aa85cd33 Follow on Social Media Platforms Contribute us Want to Learn t...
domainhunter
Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...
lazyrecon
/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com About...
CVE-2026-61812
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser ...
LANs.py
LANs.py NOTE I do not maintain this anymore. I highly suggest using bettercap instead for ARP and MITM needs. Automatically find the most active WLAN users then spy on one of them and/or inject arbitrary HTML/JS into pages they visit. Individually poisons the ARP tables of the target box, the...
EUVD-2026-120507
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser ...
CVE-2026-61812
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser ...
CVE-2026-61812 ModSecurity: HTML decoder missing entities, leading to evasion
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser ...
CVE-2026-61812
The ModSecurity web application firewall (WAF) engine is vulnerable to rule evasion due to a limitation in the t:htmlEntityDecode transformation. Prior to versions 2.9.15 and 3.0.17 , the decoder recognizes only a small subset of named HTML entities, allowing attackers to encode ASCII separators ...
maigret
Maigret English · 简体中文 · Français 📖 Documentation Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors Go beyond account enumeration...
traQ: XSS in the User Uploaded File Retrieval API
Impact For instances where TRAQSTORAGETYPE is set to local, the file retrieval API /files/fileId could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser. As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML...
GHSA-P74G-F95M-7FX7 traQ: XSS in the User Uploaded File Retrieval API
Impact For instances where TRAQSTORAGETYPE is set to local, the file retrieval API /files/fileId could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser. As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML...