OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection

OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters. id: CVE-2023-25826 info: name: OpenTSDB = 2.4.1 -...

burp-cc-bridge

CC-Bridge Una extensión de Burp Suite API Montoya que expone las primitivas más útiles de Burp a través de una API HTTP en localhost para que un shell de codificación agéntico Claude Code, OpenAI Codex, etc. pueda conducir Burp desde curl. Funciona en Burp Community. Descargar Obtenga el último J...

Crimson-Cloak-ISH-wrapper-iOS-

Crimson-Cloak-ISH-wrapper-iOS 用于无需越狱最大化 iSH iOS 应用能力的封装器。 功能 HTTP API + 内嵌仪表板，地址为 http://127.0.0.1:8088 WebSocket 实时流，地址为 ws://127.0.0.1:8089 自动发现 SynChan 工具（Huginn、OmnINT、Daedalus、Argus、Neural、Ophelia、Hecate、MIDAS、SynChan、Crimson Cloud） 每个工具的快捷按钮 剪贴板同步、文件监视器、网络监控、保活 SSH 反向隧道自动连接到 Kali/Pi iOS...

CypherDog

CypherDog4.3 PoSh BloodHound Dog Whisperer también conocido como Cmdlets de PowerShell para interactuar con los datos de BloodHound a través de la API HTTP de Neo4j Compatible con BloodHound 4.3+ y neo4j 4.4+...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

CVE-2019-20933

Laboratorio 5-CVE-2019-20933 I. ANÁLISIS DEL SISTEMA Identificación de la Superficie de Ataque Comenzando por lo que se está ejecutando en el entorno. Enumero todos los contenedores activos: docker ps La víctima expone un único puerto:8086. Actualmente, no dispongo de información detallada sobre ...

CVE-2014-3120

LAB 10-CVE-2014-3120 I. ANÁLISIS DEL SISTEMA Identificación de la superficie de ataque desde el entorno Docker Empezamos por lo que se está ejecutando en el entorno. Listamos todos los contenedores activos: docker ps Resultado: El contenedor p1/lab10:latest está en ejecución y expone 2 puertos...

BIT-RABBITMQ-2026-67415 RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to th...

BIT-RABBITMQ-2026-67218 RabbitMQ: Super-stream HTTP creation skips configure-permission check

RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, acceptcontent/2 at line 56 calls rabbitstreammanager:createsuperstream/... directly after isauthorized which only checks the management tag + vhost access via isauthorizedvhost. The stream-protocol...

CVE-2026-103270

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-103270

LightLLM versions up to and including 1.2.0 are vulnerable to a missing authentication flaw on reinforcement learning (RL) control routes. When deployments are started with the --enable_rl flag, the software mounts specific control routes on the public HTTP API without requiring authentication ch...

EUVD-2026-89989

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-103270: Missing Authentication for Critical Function

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-102878

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878

The mcp-chrome-bridge software, in versions through 1.0.31 , contains an origin validation error within its native-server HTTP API. This vulnerability allows an attacker to bypass CORS restrictions by crafting malicious web pages. Successful exploitation enables the execution of browser automatio...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

EUVD-2026-89413

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878: Origin Validation Error

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...