CVE-2026-36374

Description A public endpoint has been identified that allows certificate lookup using a predictable identifier certificate code, without any authentication or authorization mechanism. By enumerating this identifier, an attacker can access third-party personal data, including full name, CPF...

CVE-2022-39197

CVE-2022-39197 CVE-2022-39197 "ID": "CVE-2022-39197", "STATE": "RESERVED"...

boringssl

BoringSSL BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no...

cvelistV5

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

gdid-reversal

Full writeup of the Windows GDID Global Device Identifier fully reverse engineered -8a2be2 -0078d6 How Microsoft's "Global Device Identifier", the persistent Windows fingerprint named in the July 2026 Scattered Spider complaint, is actually generated, stored, and transmitted. TL;DR !NOTE Listed...

FlowName

FlowName Name quality shows the ratio of names exclusively preferred by an automated, uncalibrated Jev evaluation.Animated chart → · Exact counts, method and limitations → Try FlowName in your browser → — enter your JavaScript, API key and model; no installation required. CLI: npx --yes...

zotlit-PoC

ZotLit: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-4qh7-66xv-h329. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-zotlit-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

CVE-2021-42694

CVE-2021-42694 This script implements a Homoglyph detection tool, primarily used to detect potential CVE-2021-42694 vulnerabilities in code. Let me explain its main functions in detail: Core Features: Detect homoglyph substitution attacks in code Scan identifiers such as variable names and functi...

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

hash-identifier

hash-identifier Software to identify the different types of hashes used to encrypt data and especially passwords. Encryption formats supported: ADLER-32 CRC-32 CRC-32B CRC-16 CRC-16-CCITT DESUnix FCS-16 GHash-32-3 GHash-32-5 GOST R 34.11-94 Haval-160 Haval-192 110080 ,Haval-224 114080 ,Haval-256...

tinfoleak

tinfoleak The most complete open-source tool for Twitter intelligence analysis Introduction tinfoleak is an open-source tool within the OSINT Open Source Intelligence and SOCMINT Social Media Intelligence disciplines, that automates the extraction of information on Twitter and facilitates...

Intensio-Obfuscator

Intensio-Obfuscator Project not maintained anymore Thanks to all contributors What is this ? Intensio-Obfsucator tool takes a python source code and transform it into an obfuscated python code Replace all names of variables/classes/functions/files-name to random strings with length defined then a...

CVE-2025-22870

PoC – CVE-2025-22870 – HTTP Proxy Bypass via IPv6 Zone ID in Go Summary This Proof of Concept demonstrates the exploitation of CVE-2025-22870, a vulnerability in the golang.org/x/net/http/httpproxy package prior to v0.36.0, which can be used to bypass HTTP proxy restrictions by abusing the way IP...

config-demo

CVE-2020-5410...

CVE-2026-113813

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...

EUVD-2026-111728

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...

Issabel Authenticated - Remote Code Execution

A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asteriskcli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated...

CVE-2025-4162025

Security Advisory: CVE-2025-4162025 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

CVE-2026-116886 Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse

Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Brows...

CVE-2026-116886

Semantic MediaWiki versions 2.5.0 before 7.3.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability. Users with page-edit rights can inject malicious scripts by providing them as External identifier property values. Because the ExternalIdentifierValue function renders these payload...