CVE-2026-75601

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-74771

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering...

CVE-2026-66003

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...

CVE-2026-49809

Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-47844

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-46370

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2026-46371

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-55227

Weblate , a web-based localization tool, is affected by an information disclosure vulnerability in versions prior to 2026.7 . Several endpoints perform object lookups in a globally scoped manner rather than restricting them to projects the requesting user can access. As a result, they return HTTP...

CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

misp-taxonomies

MISP Taxonomies MISP Taxonomies è un insieme di librerie di classificazione comuni per etichettare, classificare e organizzare le informazioni. La tassonomia consente di esprimere lo stesso vocabolario tra un insieme distribuito di utenti e organizzazioni. Le tassonomie che possono essere...

CaA

Insight sobre informações, explorando com inteligência de mil maneiras. Primeiro Autor: EvilChen Segundo Autor: 0chenccMystery Security TeamTerceiro Autor: Mystery Security Team...

GooFuzz

GooFuzz - O Poder dos Google Dorks Créditos Autor: M3n0sD0n4ld Twitter: @DavidUton Descrição: GooFuzz é um script escrito em Bash Scripting que usa técnicas avançadas de busca do Google para obter informações sensíveis em arquivos ou diretórios sem fazer requisições ao servidor web. Novidades Que...

dns-zone-audit

Auditoria de Zona DNS Uma ferramenta de segurança leve baseada em Bash para testar configurações incorretas de transferência de zona DNS AXFR, associadas ao CVE-1999-0532. Este script consulta servidores de nomes autoritativos para um domínio e tenta transferências de zona completas. Se...

killshot

Questo progetto non è più mantenuto ! KILLSHOT Un framework per il penetration testing, strumento di raccolta informazioni e scanner di vulnerabilità web Perché KillShot? Puoi utilizzare questo strumento per eseguire lo spider del tuo sito web, raccogliere informazioni importanti e automatizzare ...

s3-leaks

s3-leaks Liste der AWS-S3-Lecks Wenn dir weitere Lecks bekannt sind, sende gerne einen PR...

cpufetch

Strumento semplice ma elegante per ottenere informazioni sull'architettura della CPU cpufetch è uno strumento da riga di comando scritto in C che mostra le informazioni sulla CPU in modo pulito e bello...

CVE-2023-4966

CVE-2023-4966 Эксплойт-скрипт, разработанный для эксплуатации уязвимости раскрытия информации CVE-2023-4966 Citrix Bleed Хакеры активно эксплуатируют эту уязвимость шлюза Citrix. Данный эксплойт-скрипт поддерживает конкурентность и может эксплуатировать как отдельные цели, так и файлы с целями...

CVE-2025-56499

CVE-2025-56499 قراءة ملف عشوائي عبر عدم التحقق من صحة المسار في موفر القاعدة المحلي الإصلاح في المصدر: https://github.com/MetaCubeX/mihomo/pull/2177 الإصدارات المتأثرة: mihomo = v1.19.11 ملخص عند تحليل تكوين rule-providers، يفشل الفرع type = "file" في التحقق من صحة المسار المقدم. يمكن للمهاجم...