CVE-2026-67218

RabbitMQ messaging and streaming broker versions prior to 4.0.22, 4.1.11, 4.2.6, and 4.3.0 are vulnerable to a privilege escalation flaw. The HTTP handler for accept_content/2 fails to call rabbit_stream_utils:check_super_stream_management_permitted/4, which is required to enforce configure permi...

OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection

OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters. id: CVE-2023-25826 info: name: OpenTSDB = 2.4.1 -...

burp-cc-bridge

CC-Bridge Una extensión de Burp Suite API Montoya que expone las primitivas más útiles de Burp a través de una API HTTP en localhost para que un shell de codificación agéntico Claude Code, OpenAI Codex, etc. pueda conducir Burp desde curl. Funciona en Burp Community. Descargar Obtenga el último J...

Crimson-Cloak-ISH-wrapper-iOS-

Crimson-Cloak-ISH-wrapper-iOS 用于无需越狱最大化 iSH iOS 应用能力的封装器。 功能 HTTP API + 内嵌仪表板，地址为 http://127.0.0.1:8088 WebSocket 实时流，地址为 ws://127.0.0.1:8089 自动发现 SynChan 工具（Huginn、OmnINT、Daedalus、Argus、Neural、Ophelia、Hecate、MIDAS、SynChan、Crimson Cloud） 每个工具的快捷按钮 剪贴板同步、文件监视器、网络监控、保活 SSH 反向隧道自动连接到 Kali/Pi iOS...

CVE-2026-67827

ZLMediaKit (commit 9fd5152) is affected by an Incorrect Access Control vulnerability in its HTTP API module . A remote, unauthenticated attacker can exploit the setServerConfig API endpoint to overwrite the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are then...

CypherDog

CypherDog4.3 PoSh BloodHound Dog Whisperer también conocido como Cmdlets de PowerShell para interactuar con los datos de BloodHound a través de la API HTTP de Neo4j Compatible con BloodHound 4.3+ y neo4j 4.4+...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

CVE-2014-3120

LAB 10-CVE-2014-3120 I. ANÁLISIS DEL SISTEMA Identificación de la superficie de ataque desde el entorno Docker Empezamos por lo que se está ejecutando en el entorno. Listamos todos los contenedores activos: root@kitploit: docker ps Resultado: El contenedor p1/lab10:latest está en ejecución y expo...

CVE-2019-20933

Laboratorio 5-CVE-2019-20933 I. ANÁLISIS DEL SISTEMA Identificación de la Superficie de Ataque Comenzando por lo que se está ejecutando en el entorno. Enumero todos los contenedores activos: root@kitploit: docker ps La víctima expone un único puerto:8086. Actualmente, no dispongo de información...

EUVD-2026-70264

Windows ML CLI: CORS misconfig enables localhost RCE...

CVE-2026-82533 DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...

CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

CVE-2026-85619

AppFlowy-Cloud 0.9.64 contains an authorization bypass in its collaboration object access control (libs/access-control/src/casbin/collab.rs). The service fails to verify that requested collab objects belong to the caller's workspace, allowing an authenticated attacker to supply a victim's object ...

EUVD-2026-70284

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...

CVE-2026-84886

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...

CVE-2026-84886 simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...

CVE-2026-84886 simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...

CVE-2026-84886

A resource consumption vulnerability affects the OCR HTTP API component of simular-ai Agent-S versions up to 0.3.2. The flaw resides in the ImageData function within the file gui_agents/s1/utils/ocr_server.py, where manipulation of the img_bytes argument can exhaust system resources. The attack i...