PT-2026-104655

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http connection in lib/gist.rb sets VERIFY NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth toke...

CVE-2026-104286-POC

Exploit de Path Traversal en FortiMail CVE-2026-104286 Descripción general Exploit avanzado de escritura arbitraria de archivos remota y no autenticada para CVE-2026-104286 en FortiMail. Las solicitudes HTTP/HTTPS manipuladas eluden la sanitización de rutas en el cliente web, lo que permite la...

CVE-2026-13249

CVE-2026-13249 — Carga de archivos sin autenticación en Honeywell PD45 RCE PoC en Python 3 para CVE-2026-13249 — interfaz de administración web de la impresora industrial Honeywell PD45. Descripción PoCbit / GitHub CVE-2026-13249 — El firmware F10.19.010040 hasta antes de F10.22.030745 expone una...

EUVD-2026-91837

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu versions prior to 3.0.0 are vulnerable to a missing authentication flaw in the Playground feature. This vulnerability allows unauthenticated attackers to proxy arbitrary HTTP and HTTPS requests to URLs on the public internet. No specific exploit details or remediation steps are provid...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

zoshrinkC2

MeliziaC2 Malware dirigido que usa DNS-over-HTTPS solo se ejecuta una vez ! Algunas funciones aún no están disponibles ! ! WIP, no usar en producción ! Características principales Autoeliminación del malware en caso de fallo Comunicación DoH DNS-over-HTTPS totalmente cifrada clave RSA por víctima...

CVE-2026-104459

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

Lack of vulnerability protection in Fortinet FortiMail

Fortinet has identified a vulnerability in FortiMail. FortiMail contains a critical vulnerability CVE-2026-104286 in the processing of file paths, caused by a combination of Path Traversal CWE-22 and insufficient neutralization of NULL bytes CWE-158. An unauthorized attacker can use specially...

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The U.S. Cybersecurity and Infrastructure Security Agency CISA, on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 CVSS score: 9.8,...

https-everywhere

HTTPS Everywhere 更新信息 ⚠️ 该项目已不再维护或更新。请卸载并引导用户参考下方建议，通过浏览器原生方式默认启用 HTTPS。 你不再需要 HTTPS Everywhere 来默认设置 HTTPS！主流浏览器现已原生支持仅 HTTPS 模式。 点击此处了解如何开启该功能。 此扩展将于 2023 年 1 月停止使用。 HTTPS Everywhere 入门指南 HTTPS Everywhere 是一款 Firefox、Chrome 和 Opera 扩展，可加密您与许多主流网站的通信，使您的浏览更加安全。加密网络：立即安装 HTTPS Everywhere。 针对用户...

mitmengine

MITMEngine 废弃声明：此软件不再维护。 本项目旨在实现HTTPS中间人拦截的精确检测以及健壮的TLS指纹识别。 该项目基于论文《The Security Impact of HTTPS Interception》，最初是将其处理脚本和指纹移植到Go语言。 关于MITMEngine的更多背景信息，请参阅这篇 Cloudflare博客文章。 快速链接： 签名与指纹：核心定义 MITM检测方法 API 使用示例 构建与测试 如何贡献 mergeDB工具 系统要求 Go Wireshark 3.0.0（用 wireshark -v 检查版本） 文档 详细文档随代码提供（先将包复制到...

NSEC3-X

免责声明：本项目由人工智能（AI）生成，但经过了严格的“人在环路”（HITL）流程。这意味着代码已由人类软件工程师审查和重构，架构设计由人类指导，并执行了基本的安全审计以验证功能并排除典型的AI幻觉。该流程确保的质量和可靠性是纯AI生成无法保证的。 NSEC3-X NSEC3-X 是一款专为审计 DNSSEC NSEC3 配置而设计的专业取证与渗透测试工具。它提供了 nsec3walker 等传统工具的现代高性能替代方案，集成了区域枚举（收割）和哈希逆向（破解）功能。 该工具使用 Go 语言编写，设计为自包含、无依赖的二进制文件，适用于受限环境中的部署。 技术概述...

CVE-2026-105049: Missing Authentication for Critical Function

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

PT-2026-104452

Name of the Vulnerable Software and Affected Versions Zilliz Attu versions prior to 3.0.0 Description The Playground feature allows the proxying of arbitrary HTTP and HTTPS requests to URLs on the public internet without requiring authentication. This leads to a Server-Side Request Forgery SSRF, ...

CVE-2026-104286

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on th...

ca-clone

Scripts de Clonación de CA Scripts para clonar certificados de CA para su uso en ataques a clientes HTTPS. Actualmente se incluyen scripts para clonar una CA raíz de Comodo y una CA de Digicert, ambas ampliamente confiables en dispositivos IoT. Uso Ejecute cualquiera de los scripts directamente...