CVE-2026-109597: Improper Neutralization of Input During Web Page Generation

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

PT-2026-111016

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

web-traffic-generator

web-traffic-generator Un generador de tráfico HTTP/S "orgánico" rápido y sucio. Acerca de Es solo un script de Python simple mal escrito que "navega" sin rumbo por internet empezando desde ROOTURLS predefinidas y "haciendo clic" aleatoriamente en enlaces de páginas hasta alcanzar la MAXDEPTH...

pig

Pig Pig que puede entenderse como Packet intruder generator es una herramienta de creación de paquetes para Linux. Puedes usar Pig para probar tu IDS/IPS, entre otras cosas. Pig incluye un conjunto de firmas de ataque conocidas listas para usar y puedes ampliar esta colección con cosas más...

CVE-2026-108730 Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/ravenmessage.py that skip the workspace membership check. Authenticated non-members can call getmessageswithdates or getallfilessharedinchannel with predictable channel IDs to read Public chann...

CVE-2026-108710 NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints

NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node ID...

CVE-2026-108710

NornicDB versions through 1.4.1 are vulnerable to a missing authorization flaw (CWE-862) affecting the /nornicdb/search and /nornicdb/similar endpoints. This vulnerability allows authenticated users with a viewer-role —who are allowlisted for a database but explicitly denied read permissions—to b...

sniffles

Sniffles--Generador de Capturas de Paquetes para IDS y Evaluación de Expresiones Regulares Sniffles es una herramienta para crear capturas de paquetes que probarán IDS que usan patrones fijos o expresiones regulares para detectar comportamientos sospechosos. Sniffles funciona de manera muy simple...

skyhook

Skyhook Skyhook es una utilidad basada en REST que se usa para introducir y extraer archivos de redes protegidas por implementaciones de IDS. Viene con un cliente web preempaquetado que utiliza una combinación de React, vanilla JS y WebAssembly para gestionar transferencias de archivos. Enlaces...

CVE-2026-108622

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to...

CVE-2026-108671

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability (CWE-862) in the AiragMcpController . Specifically, the permission check for the queryById function is commented out, allowing any authenticated user to access sensitive data. Attackers can exploit this by obta...

CVE-2026-108634

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the sysDepartPermission component. Specifically, the DELETE /sys/sysDepartPermission/deleteBatch endpoint fails to properly validate permissions, allowing low-privileged authenticated users to delete departm...

CVE-2026-108579

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...

CVE-2026-108579 OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...

EUVD-2026-96362

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...

PT-2026-109670

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 2.3.1 Description An issue allows unauthenticated attackers to embed spreadsheet formulas by providing crafted profile IDs to the '/track' endpoint. By sending tracking events with profile IDs such as =HYPERLINK...

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Summary The task-collection endpoint GET /api/v1/projects/project/views/view/tasks loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a link-share token, the task query is correctly pinned to the share's own project, but the view is...

teler

!IMPORTANT Estimados usuarios, Queremos compartir algunas actualizaciones importantes sobre el desarrollo de teler IDS. 🛑 El desarrollo de teler IDS está actualmente en pausa. Sin embargo, nos complace informarles que hemos decidido dar un paso audaz: emprender una reestructuración completa,...

nanoid-noninteger-size-poc

nanoid: predictable IDs for non-integer size 5.1.8 - 5.1.16...

CVE-2026-107828: Use of Weak Credentials

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina sets the password to the first four digits of the Weibo I...