ROOT-APP-NPM-CVE-2026-27904 CVE-2026-27904 in minimatch - Patched by Root

Root has patched CVE-2026-27904 in the minimatch package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-39Q2-94RC-95CP GHSA-39q2-94rc-95cp in dompurify - Patched by Root

Root has patched GHSA-39q2-94rc-95cp in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-H8R8-WCCR-V5F2 GHSA-h8r8-wccr-v5f2 in dompurify - Patched by Root

Root has patched GHSA-h8r8-wccr-v5f2 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-CMWH-PVXP-8882 GHSA-cmwh-pvxp-8882 in dompurify - Patched by Root

Root has patched GHSA-cmwh-pvxp-8882 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in dompurify - Patched by Root

Root has patched CVE-2026-49978 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41240 CVE-2026-41240 in dompurify - Patched by Root

Root has patched CVE-2026-41240 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-R28C-9Q8G-F849 GHSA-r28c-9q8g-f849 in postcss - Patched by Root

Root has patched GHSA-r28c-9q8g-f849 in the postcss package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54287 CVE-2026-54287 in hono - Patched by Root

Root has patched CVE-2026-54287 in the hono package for Root:npm. Multiple fixed versions available...

MS-SharePoint-July-Patch-RCE-PoC

MS-SharePoint-July-Patch-RCE-PoC PoC para: CVE-2024-38094 CVE-2024-38024 CVE-2024-38023 Video del PoC: https://youtu.be/u8mccaakISw...

Vulnerability-Disclosure-Policy

Política de divulgación de vulnerabilidades Creemos que la divulgación de vulnerabilidades es una calle de doble sentido. Tanto los proveedores como los investigadores deben participar en la divulgación coordinada de vulnerabilidades. Cuando Enable Security descubre vulnerabilidades a través de s...

Sherlock

已弃用。请改用 Watson。 Sherlock 用于快速查找缺失的本地权限提升漏洞软件补丁的PowerShell脚本。 当前检测以下漏洞： MS10-015 : 用户模式到环 KiTrap0D MS10-092 : 任务计划程序 MS13-053 : NTUserMessageCall Win32k 内核池溢出 MS13-081 : TrackPopupMenuEx Win32k NULL 页面 MS14-058 : TrackPopupMenu Win32k 空指针解引用 MS15-051 : ClientCopyImage Win32k MS15-078 : 字体驱动程序缓冲区溢出...

python-patrol

Python 巡检 扫描 macOS 上的 Python 安装，并运行 CVE-2015-20107.py 脚本报告是否需要修补 其中几个脚本需要“完全磁盘访问权限”，并且必须以 root 身份运行，以便扫描整个 macOS 文件系统（macOS 限制的区域除外）。 确保从具有完全磁盘访问权限的应用程序运行此脚本 - 即确保 iTerm.app 在 Apple 系统设置、安全性与隐私、隐私与安全性中启用了完全磁盘访问权限。 使用方法 克隆此仓库 进入克隆的仓库目录 运行 sudo ./python-patrol.zsh 示例输出： ... lrwxr-xr-x 1 root wheel ...

Windows-Exploit-Suggester

描述 此工具将目标的补丁级别与微软漏洞数据库进行对比，以检测目标可能缺失的补丁。同时，它还会通知用户是否存在针对缺失公告的公开漏洞利用程序和Metasploit模块。 它需要Windows主机的'systeminfo'命令输出，以便与微软安全公告数据库进行比较，从而确定主机的补丁级别。 它能够使用--update标志自动从微软下载安全公告数据库，并将其保存为Excel电子表格。...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10546 info: name:...

Apache Superset - Authentication Bypass

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...

Qlik Sense Enterprise - HTTP Request Smuggling

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

FUEL CMS 1.4.1 - Remote Code Execution

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. id: CVE-2018-16763 info: name: FUEL CMS 1.4.1 - Remote Code Execution author: pikpikcu severity: critical description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/...

CraftCMS - Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...