Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection

Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability. id: CVE-2021-21881 info: name:...

Oracle E-Business Suite - Blind SSRF

Oracle E-Business Suite, Application Management Pack component User Monitoring subcomponent, is susceptible to blind server-side request forgery. An attacker with network access via HTTP can gain read access to a subset of data, connect to internal services like HTTP-enabled databases, or perform...

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

Oracle WebLogic Server - Remote Code Execution

Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access. id: CVE-2021-2135 info: name: Oracle WebLogic Server - Remote Code Execution author:...

Oracle Weblogic - Server-Side Request Forgery

An unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services. id: CVE-2014-4210 info: name: Oracle Weblogic - Server-Side Request Forgery author:...

Oracle WebLogic Server - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions...

Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...

TP-Link - OS Command Injection

The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840NEUV5171211 is vulnerable to remote code execution via a specially crafted payload in an IP address input field. id: CVE-2021-41653 info: name: TP-Link - OS Command Injection author: gy741 severity: critical...

Gradio - Server Side Request Forgery

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

CHN-Server

CHN-Server Servidor de Community Honey Network Encuentra la documentación aquí: https://communityhoneynetwork.readthedocs.io...

mass-bruter

Mass Bruter Fuerza bruta masiva de protocolos de red Información POC simple para forzar rápidamente servicios comunes en una gran escala de red. Comprobará credenciales por defecto en ftp, ssh, mysql, mssql...etc. Esto fue creado únicamente con fines de pruebas de penetración autorizadas. Cómo...

mass-bruter

Mass Bruter Mass bruteforce network protocols Info Simple POC to quickly mass bruteforce common services in a large scale of network. It will check for default credentials on ftp, ssh, mysql, mssql...etc. This was made for authorized penetration testing purpose only. How it works 1. Use...

HeartBleed

Vulnerabilidad HeartBleed en docker 1. git clone https://github.com/Saymeis/HeartBleed.git 2. cd HeartBleed 3. sudo docker build -t heartbleed -f Dockerfile . 4. sudo docker run -p 80:80 -p 443:443 -d heartbleed...

CLEANSTART-2026-MW74031 Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network

Security vulnerability affects the apache-hive package. Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network...

CLEANSTART-2026-IL67419 Netty is an asynchronous, event-driven network application framework

CVE-2026-42580 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-NR95500 Netty is an asynchronous, event-driven network application framework

CVE-2026-42581 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-UQ14392 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

CLEANSTART-2026-CD04274 Security fix for ghsa-hrxh-6v49-42gf applied in: aws-network-policy-agent 1.2.7-r0, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, step 0.30.2-r4, kube-state-metrics-fips 2.20.0-r4, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

ghsa-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KW79982 Security fix for ghsa-259r-337f-4rfw applied in: aws-network-policy-agent 1.1.6-r4, caddy 2.11.4-r1, fabric-peer 2.5.16-r2, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, kubernetes-dns-node-cache 1.23.1-r2, step 0.30.2-r4

ghsa-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-107849

The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to...