156244 matches found
CVE-2026-101057 utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL
utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...
basketcraft
basketcraft este es un script que explota la vulnerabilidad CVE-2023-27163, que es un SSRF en request-baskets versiΓ³n 1.2.1 SSRF en Request-Baskets CVE-2023β27163 CVE-2023β27163 representa una vulnerabilidad crΓtica de falsificaciΓ³n de solicitudes del lado del servidor Server-Side Request Forgery...
selinux-netfix
Local Area Network Connection Repair Tool SELinux Network Cac...
tor-rootkit
tor-rootkit Un rootkit independiente en Python 3 para Windows 10 / Linux. La comunicaciΓ³n de red se establece a travΓ©s de la red tor. Este rootkit es WIP. Aviso legal Γselo solo con fines educativos. CΓ³mo usar 1. Clona el repositorio y cambia de directorio: root@kitploit: git clone...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getMediaFromRemoteUrl function. An attacker can access internal network resources or read arbitrary files by supplying a crafted remote playlist URL that points to internal HTTP endpoints or loca...
CVE-2026-100849
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...
Oracle WebLogic Server - Remote Code Execution
Oracle WebLogic Server Oracle Fusion Middleware component: WLS Core Components is susceptible to a remote code execution vulnerability. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 2.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability could allow unauthenticated...
CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...
Application Agnostic EM Side-Channel Emanations of the FPGA Clock Distribution Network
Electromagnetic side channels have been extensively utilized in non-invasive attacks or analyses to extract critical information from deployed systems. Most of the attacks or analyses are typically executed on cryptographic algorithms under the assumption that the underlying implementation remain...
PT-2026-99569
Name of the Vulnerable Software and Affected Versions utcp-mcp versions prior to 1.1.3 Description The MCP plugin of python-utcp fails to apply ensure secure url validation when connecting to HTTP and WebSocket MCP server URLs defined in a call template's mcpServers configuration. This omission...
PT-2026-99548
Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246.071246 Description An OS command injection flaw exists in the Tools Ping Handler component. A remote attacker can trigger this issue by manipulating the url argument passed to the system function with...
CVE-2026-101057: Cleartext Transmission of Sensitive Information
utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...
PT-2026-99547
Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246 Description An OS command injection flaw exists in the Web Management Interface component. A remote attacker can exploit this by manipulating the QUERY STRING argument passed to the eval function with...
Linux Distros Unpatched Vulnerability : CVE-2026-100696
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery SSRF vulnerability in the optional Elasticsearch driver...
The Cost of Stability: Deanonymizing Onion Services Long-Lived Introduction Circuits
Tor is a widely used anonymity network that provides network privacy by routing client communications through a sequence of relays to their destinations. An adversary observing a single Tor relay cannot readily link clients to their destinations, as doing so requires identifying the other relays...
SpectralCovert
π‘ SpectralCovert -brightgreen.svg Deterministic Cryptographic Network Covert Channel & Shannon Entropy Leak Detector Developed by ΓΔ±nar @prox0959 Academic Grade | Zero External Dependencies | Sub-Millisecond Analysis π¬ Overview & Problem Statement Modern firewalls, deep packet inspection DPI...
CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery SSRF vulnerability in the optional Elasticsearch driver plugins/drivers/elastic.php, fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect before the login result is validated, an...
DEBIAN-CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery SSRF vulnerability in the optional Elasticsearch driver plugins/drivers/elastic.php, fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect before the login result is validated, an...
CVE-2026-100681
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...
CVE-2026-100601
ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...