shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

npcap

Npcap Npcap is a packet capture and injection library for Windows by the Nmap Project. It is a complete update to the unmaintained WinPcap project with improved speed, reliability, and security. Documentation The complete documentation for Npcap is available in the Npcap Guide on npcap.com. There...

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

CVE-2026-104458

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

EUVD-2026-91469

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104458

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the validateKeyIdUrl() function. This flaw allows unauthenticated attackers to bypass the existing SSRF guard by utilizing 6to4, NAT64, or IPv4-compatible IPv6 addresses . By sending a craf...

CVE-2026-91828

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

EUVD-2026-91191

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

CVE-2026-91828

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin (versions before 6.3.11 ) is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because the plugin fails to require authentication or a valid nonce for an action that triggers a slow server-side l...

CVE-2026-51585

realtek poc rt26cx21x64.sys 漏洞利用（Realtek PCIe GbE/2.5GbE/5GbE 系列） 概述 OID 0xFF816871 将网卡的 mmio bar 映射到调用进程的虚拟地址空间中， （MmLockedPagesSpecifyCache），可通过 \.\RealTekCardGUID 从用户态访问 该 IOCTL（0x0012C818）受注册表值（DrvMode=4）控制 一旦我们获得 mmio 寄存器访问权限，就可以在环回模式下对网卡的 tx/rx 描述符环进行编程，...

PT-2026-104091

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

MCP Atlassian: SSRF Protection Bypass

Environment- Project: sooperset/mcp-atlassian- Affected function: validateurlforssrf- Affected path: header-based Jira/Confluence URL authentication flow- Tested endpoint: POST /mcp- Tested version: 2.14.5 DescriptionThe SSRF protection in validateurlforssrf can be bypassed with a URL containing ...

CVE-2026-33534

CVE-2026-33534 - EspoCRM 9.3.3 认证后 SSRF 针对 EspoCRM 9.3.3 中 /api/v1/Attachment/fromImageUrl 端点通过替代 IPv4 环回表示法实现认证后 SSRF 的概念验证。 摘要 EspoCRM 9.3.3 会阻止诸如 http://127.0.0.1/... 之类的直接环回 URL，但服务端获取路径接受 cURL 会将其规范化为环回的替代 IPv4 表示形式。这使得有权访问受影响附件/图片上传流程的认证用户能够使 EspoCRM 服务器获取内部资源。 该漏洞利用首先提交一个直接的 127.0.0.1...

FreeBSD : FreeBSD -- IPv6 UDP sendto(2) bypasses jail loopback restriction (6d92b2a3-bcce-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6d92b2a3-bcce-11f1-906f-bc241121aa0a advisory. The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback...

CVE-2026-72018

CVE-2026-72018 — Linux 内核越界写入 Linux 内核 • DIBS 回环 • 越界写入 CVE-2026-72018 的安全研究与技术分析。 01 — 概述 CVE-2026-72018 是一个影响 DIBS/ISM 回环功能的 Linux 内核越界写入 漏洞。 该漏洞与传入已注册 DMB（数据内存缓冲区） 的数据处理有关。 受影响的实现未在执行内存操作之前充分验证所提供的偏移量、传输大小与实际 DMB 边界之间的关系。 漏洞分类 属性| 值 ---|--- CVE| CVE-2026-72018 CWE| CWE-787 — 越界写入 CVSS v3.1| 7....

FreeBSD -- IPv6 UDP sendto(2) bypasses jail loopback restriction

Problem Description: The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. Impact: A process in a classic non-VNET jail can send UDP datagrams to services listening on the host's IPv6 loopback...

ida-pro-mcp

IDA Pro MCP ⚠️ Archived — superseded by the official Hex-Rays IDA MCP server This project is no longer maintained. On 2026-09-27 Hex-Rays SA released the Official IDA MCP Server and IDA Nexus. Development stopped the same day at 1.0.0a4. For current use, install theirs: uvx ida-hcli mcp install. I...

CVE-2026-101058

python-utcp pip package utcp-http before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensuresecureurl intentionally permits loopback HTTP for...

CVE-2026-101058

The python-utcp (pip package utcp-http ) version before 1.1.12 is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists because the software fails to verify if tool URLs declared in a hand-written UTCP manual point to the host's loopback interface (127.0.0.1) when the manual is fet...

CVE-2026-101058 python-utcp before 1.1.12 SSRF via Remote HTTP Manual

python-utcp pip package utcp-http before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensuresecureurl intentionally permits loopback HTTP for...