CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

GitMiner

⚠️ Repository veraltet – Projekt ersetzt Dieses Repository wird nicht mehr gewartet und ist offiziell veraltet. Das Projekt wird aktiv weiterentwickelt unter: https://github.com/unkl4b/Gitminer3 Bitte migrieren Sie zu GitMiner3 , um die neuesten Updates, Verbesserungen und aktiven Support zu...

CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

google-dorks-bug-bounty

Google Dorks für Bug Bounty Eine Liste von Google Dorks für Bug Bounty, Web Application Security und Pentesting Live-Tool Breite Domain-Suche mit Negativsuche root@kitploit: site:example.com -www -shop -share -ir -mfa PHP-Erweiterung mit Parametern root@kitploit: site:example.com ext:php inurl:?...

CVE-2026-41262

Fleet (open-source device management platform) versions prior to 4.85.0 contain an authorization bypass in the global policy read endpoint. The GetPolicyByIDQueries handler authorizes against an empty policy object with a nil TeamID, which the OPA policy rule permits for any user holding a role o...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

espectre

🛜 ESPectre 👻 Bewegungserkennungssystem basierend auf Wi-Fi-Spektrumanalyse CSI, mit nativer Home-Assistant-Integration über ESPHome. !TIP Neuer ML-Detektor : Bewegungserkennung auf Basis neuronaler Netze. Keine Kalibrierung erforderlich, läuft auf dem Gerät. Dies ist eine experimentelle Funktion;...

pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

Mr.Holmes

🔍 Mr.Holmes Mr.Holmes è uno strumento di raccolta informazioni OSINT. Lo scopo principale è ottenere informazioni su domini, nomi utente e numeri di telefono utilizzando fonti pubbliche disponibili su Internet; utilizza inoltre gli attacchi Google Dork per ricercatori specifici. Usa anche proxy p...

CVE-2026-80196

creationtimestamp| type| source ---|---|--- 2026-08-26 18:04:02+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117163127023272638 2026-08-26 18:04:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtyw7nsnmz2g...

Argus

Um kit de ferramentas baseado em Python para Coleta de Informações e Reconhecimento Sobre o Projeto Argus é um kit de ferramentas completo, desenvolvido em Python, projetado para otimizar o processo de coleta de informações e reconhecimento. Ele reúne uma interface limpa e intuitiva com uma ampla...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

CVE-2026-79258

A flaw was found in WebXR within Google Chrome. This incorrect authorization vulnerability allows a remote attacker, by leveraging social engineering tactics and a specially crafted HTML page, to obtain sensitive cross-origin data. This could lead to unauthorized information disclosure...

CVE-2026-79265

A flaw was found in Google Chrome. A remote attacker, who has compromised the renderer process and leveraged social engineering, could exploit an incomplete cleanup vulnerability in the GetUserMedia component. This could allow them to obtain sensitive information via a crafted HTML page...

CVE-2026-79288

A flaw was found in Google Chrome's Autofill feature on Android. Improper input validation allows a remote attacker to obtain sensitive information by tricking a user into visiting a specially crafted HTML page. This vulnerability could lead to the exposure of sensitive user data...

CVE-2026-79246

A flaw was found in chromium-browser. An information leak vulnerability exists in the DataTransfer component of Google Chrome. A remote attacker could exploit this by enticing a user to visit a specially crafted HTML page, leading to the disclosure of sensitive information...

CVE-2026-79055

A flaw was found in Google Chrome on Android. An information leak vulnerability exists in the Sharing feature. A local attacker, by leveraging social engineering tactics, could exploit this flaw through a co-installed application, potentially leading to the disclosure of sensitive information...

CVE-2026-78977

A flaw was found in Google Chrome. An uninitialized resource in the GPU component of Google Chrome on Android could allow a remote attacker to exploit this vulnerability. By crafting a malicious HTML page, the attacker could potentially read memory contents from within the sandbox environment,...