cloudlist

Features • Installation • Usage • Configuration • Running cloudlist • Supported providers • Library • Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...

domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

Node.js TLS Noncanonical IP DNS SAN Acceptance Checker

Node.js versions 22.x, 24.x, and 26.x contain an improper certificate validation issue involving non-canonical IPv4 hostnames. This offline tool assesses operator-supplied Node.js version evidence against the fixed releases...

Node.js TLS Certificate Validation Bypass

Node.js versions before 22.23.4, 24.22.1, and 26.12.1 improperly validate TLS certificates for noncanonical IPv4 hostnames, allowing a numeric DNS SAN to authenticate an IP endpoint. This advisory provides affected-version and precondition research...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

EUVD-2026-108959

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

PT-2026-122083

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Improper Certificate Validation for Non-Canonical IPv4 Hostnames

Improper Certificate Validation for Non-Canonical IPv4 Hostnames vulnerability discovered by br41ny in WordPress npm Node.js versions 22.23.4...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Improper Certificate Validation via Non-Canonical IP Hostnames

Improper Certificate Validation via Non-Canonical IP Hostnames vulnerability discovered by anagnorisis2peripeteia in WordPress npm Node.js versions 22.23.4...

Atlassian Confluence 9.1.x < 9.2.24 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104501)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104501 advisory. - fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP- family URLs. The IDN conversion path calls a...

RealMag777 HUSKY – WooCommerce Professional Product Filter vulnerability

RealMag777 HUSKY – The product filter for WooCommerce Professional versions 1.4.5 and earlier has a vulnerability that leads to information leakage. This vulnerability arises from improper handling of the parameter ‘woofsettingswoofstatserveroptions’, which allows sensitive information to be...

CVE-2026-18660 Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660

In Eclipse Jetty , specifically within the jetty-server and jetty-proxy components, a vulnerability exists where the host whitelist/blacklist performs case-sensitive matching . Because DNS hostnames are case-insensitive, an attacker can bypass these security controls by using a hostname that diff...

Astra Linux – Vulnerability in libnbd

A flaw was discovered in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier URI. This vulnerability arises because non-standard hostnames starting with ‘-o’ are incorrectly interpreted as arguments for the Secure Shell SSH...

CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

Rocky Linux 9 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_6999)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226999 advisory. OpenJDK: improper MultiByte conversion can lead to buffer overflow JGSS, 8286077 CVE-2022-21618 OpenJDK: excessive memory allocation in X.509 certificate...

Rocky Linux 9 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_7007)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227007 advisory. OpenJDK: excessive memory allocation in X.509 certificate parsing Security, 8286533 CVE-2022-21626 OpenJDK: HttpServer no connection count limit Lightweigh...