CVE-2024-5633

PoC pour CVE-2024-5633 Les caméras Longse modèle LBH30FE200W, ainsi que les produits basés sur cet appareil, fournissent un accès sans restriction à un attaquant situé dans le même réseau local vers un service binaire non documenté CoolView sur l'un des ports. Un attaquant connaissant les command...

evillcode

🔥 Evillcode - Framework MITM modulaire Framework modulaire de cybersécurité développé en Python pour l'analyse, la surveillance et la simulation d'attaques MITM sur les réseaux locaux. Il permet aux étudiants et aux professionnels de comprendre le fonctionnement interne des réseaux, des protocole...

evillimiter

Evil Limiter Этот проект — поддерживаемый форк bitbrute/evillimiter. Исходный репозиторий больше не поддерживается, поэтому этот форк продолжает разработку — исправление ошибок, новые функции и обновления совместимости. См. раздел Изменения в форке ниже. Инструмент для мониторинга, анализа и...

Origin Validation Error

Overview cline is an Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more Affected versions of this package are vulnerable to Origin Validation Error via missing WebSocket host and origin validation in the cline-hub dashboard server...

Security Bulletin: This Power System update is being released to address CVE-2026-52943, CVE-2026-43373, and CVE-2026-43194

Summary An unauthenticated attacker on the BMC's local network can cause loss of service. Vulnerability Details CVEID:CVE-2026-52943 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskbcarve helpers...

PT-2026-98278

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The HTTP server in the firmware contains a path traversal flaw. This allows an attacker connected to the device WiFi network to send a specially crafted request to access files on the...

CVE-2026-96455

The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...

GHSA-4GHV-53CQ-7WP3 Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...

Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...

GHSA-G2R2-3J32-J27X MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

CVE-2026-91129

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129

The Home Assistant home automation software is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the IPP integration (specifically within homeassistant/components/ipp/config_flow.py). Prior to version 2026.2.3 , the async_step_zeroconf function automatically processed unauthenticated _ip...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

EUVD-2026-84518

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like...

CVE-2026-91129: Server-Side Request Forgery (SSRF)

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-94050

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

CVE-2026-94050 D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

EUVD-2026-83787

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...