CVE-2026-123677

A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in...

CVE-2026-123677 xxyopen/201206030 novel Book Chapter Read BookServiceImpl.java getBookChapter authorization

A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in...

CVE-2026-123677

A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in...

EUVD-2026-118271

A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. Performing a manipulation of the argument Recipient results in improper...

CVE-2026-123664

A security flaw in nasa-gcn gcn.nasa.gov (up to commit b299b562af665878964b981a459f0a9c04b11adf ) affects the Email Notification Handler component. The vulnerability arises from improper processing of the /user/email file, where manipulating the Recipient argument leads to improper authorization ...

hades

About Hades is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs. Usage The easiest way, is probably building the project on Linux using make. git clone https://github.com/f1zm0/hades && cd hades ma...

RightHand-Persistence

RightHand Persistence inspired by CVE-2026-21509 C++ COM Context Menu Handler for Persistence A sample implementation of a Windows context menu handler using C++ and COM, demonstrating a stealthy persistence technique. By registering a custom COM object, your code executes whenever a user...

outis

outis outis is a custom Remote Administration Tool RAT or something like that. Think Meterpreter or Empire-Agent. However, the focus of this tool is neither an exploit toolkit there are no exploits nor persistent management of targets. The focus is to communicate between server and target system...

penelope

Penelope is a modern shell handler for penetration testers and CTF players. It provides a more capable alternative to basic netcat listeners, adding automatic PTY upgrades, session management, logging, file transfers and helper modules. Table of Contents 📥 Installation ⚙️ Features 🖥️ Session...

CVE-2026-85268

A flaw was found in Google Cloud Identity Platform and Firebase Authentication. An unauthenticated remote attacker can exploit a Cross-Site Scripting XSS vulnerability in the authentication handler by supplying a malicious iOS bundle identifier. This issue allows the attacker to execute arbitrary...

CVE-2026-83525

A flaw was found in Apache Kafka. An authenticated attacker with cluster administrative privileges can cause a Denial of Service DoS by sending a crafted snapshot request containing an empty topics array or a topic without partitions. Due to improper input handling in the FetchSnapshot Remote...

CVE-2026-113800

A flaw was found in Electron. When evaluating Human Interface Device HID and Universal Serial Bus USB permission requests initiated from an embedded frame iframe, Electron incorrectly passes the top-level page's origin and details to the permission handler instead of the requesting frame's. An...

CVE-2026-113798

A flaw was found in Electron. When an embedded cross-origin iframe requests pointer lock, the permission handler incorrectly identifies the request as originating from the top-level frame. A remote attacker who supplies untrusted embedded web content can exploit this vulnerability to obtain point...

h0neytr4p

Adjusted for T-Pot This fork of h0neytr4p was revised for T-Pot with the following features: Add Docker support Dockerfile, docker-compose.yml Use a single logfile instead of two Log to JSON instead of CSV Enrich JSON log file with additional info i.e. Cookies, Headers, Destination Port, etc...

EUVD-2026-117879

A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdkextenttablegetextentdatafilepath of the file libvmdk/libvmdkextenttable.c of the component Extent Data File Handler. The manipulation leads to memory...

CVE-2026-122157

A flaw was found in Yank Note. The terminal handler fails to properly sanitize input during permission checks, resulting in an operating system command injection vulnerability. A remote attacker could exploit this flaw by submitting specially crafted input, allowing arbitrary command execution on...

Hongdian H8922 3.0.5 Devices - Local File Inclusion

Hongdian H8922 3.0.5 devices are vulnerable to local file inclusion. The /logdownload.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ e.g., ../../etc/passwd This can be carried out wi...

YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery

YesWiki 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of |URL wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication. id: CVE-2026-116205 info: name: YesWiki 4.7.0 - Unauthenticated Server-Si...

Nezha Dashboard < 2.0.13 - Path Traversal

Nezha Monitoring 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs. id: CVE-2026-53519 info: name: Nezha Dashboard 2.0.13 - Path Traversal author: Aryu-RU,str4k3r severity...

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...