CVE-2026-86837

The Bookly WordPress plugin versions prior to 28.3 contains a vulnerability where it fails to properly verify a customer's identity during personal information updates. An unauthenticated attacker who possesses a customer's primary identifier can exploit this verification bypass to overwrite sens...

OWASP-Model-Card-Security-Standard

Estado: Borrador — Proyecto de OWASP en incubación Este estándar está en desarrollo activo. Las contribuciones y los comentarios son muy bienvenidos. ¿Qué es esto? Cuando descargas un modelo preentrenado de HuggingFace o de cualquier otro repositorio, estás confiando esencialmente en una caja...

presidio

Presidio - Data Protection and De-identification SDK 📣 Presidio is moving to a new home! Read more here 📣 Context aware, pluggable and customizable PII de-identification service for text and images. What is Presidio Presidio Origin from Latin praesidium ‘protection, garrison’ helps to ensure...

token-proxy

llm-token-proxy A transparent PII redaction proxy for LLM API traffic. Sits between your application and the LLM provider, pseudonymizing sensitive data on the way out and restoring it on the way back. Your LLM never sees real names, emails, IPs, or domains — it works entirely with structured...

clawshield-public

ClawShield Proxy de seguridad para agentes de IA. Se sitúa delante de OpenClaw y escanea cada mensaje en busca de inyección de instrucciones, fugas de PII y secretos, antes de que lleguen al modelo o salgan de la red. Incluye 5 agentes de IA especializados, un panel de control integrado y un moto...

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. id: CVE-2025-27225 info: name: TRUfusion Enterprise = 7.10.4.0 - Admin Conta...

Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass

Ivanti Endpoint Manager Mobile EPMM, formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available. id: CVE-2023-35078 info...

pii-shield

PII-Shield 🛡️ Zero-code log sanitization sidecar for Kubernetes. Prevents data leaks GDPR/SOC2 by redacting PII from logs before they leave the pod. PII-Shield runs in-process — CLI, sidecar, or WASM. There is no hosted API and no server your data is sent to...

privacy-parser

OpenAI Privacy Parser OpenAI shipped Privacy Filter — a model that hides PII in text. Defenders use it so data doesn't leak. But every defense has a second side. Attackers need PII too. From logs, dumps, abandoned S3 buckets, stolen inboxes. Same task: find everything personal in a pile of text...

exfilkit

exfilkit Data exfiltration utility for testing detection capabilities Description Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only. Exfiltration How-To /etc/shadow - HTTP GET requests Server root@kitploit: ./exfilkit-cli.py ...

CVE-2026-4106

CVE-2026-4106: WordPress HT Mega Unauthenticated PII Disclosure Exploit A robust, multi-threaded Proof of Concept PoC exploit for CVE-2026-4106 , targeting the HT Mega - Absolute Addons for Elementor plugin for WordPress versions 3.0.7. Vulnerability Overview The HT Mega plugin registers several...

skiptracer

Account moved to: https://gitlab.com/illwill No longer supported at this time. Python 3 migration in progress, please do not report issues yet, as the code and the sources need a bunch of upgrading. Project moved to https://gitlab.com/illwill/skiptracer...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution: control de acceso roto Divulgación de información personal identificable PII y falsificación de pedidos sin autenticación en el plugin de WordPress Eventin más de 10 000 instalaciones activas. Un endpoint REST público entrega un nonce wprest a cualquier...

CVE-2025-66698

CVE-2025-66698 Software objetivo: Veda Semantic Machines v5.4.8 probablemente todas las versiones anteriores. Tipo de vulnerabilidad: Omisión de autenticación. ID de CVE: CVE-2025-66698. Resumen: El sistema valida incorrectamente el parámetro ticket, tratando una cadena vacía como una sesión...

privacy-filter

OpenAI Privacy Filter OpenAI Privacy Filter es un modelo de clasificación de tokens bidireccional para la detección y el enmascaramiento de información de identificación personal PII en texto. Está pensado para flujos de trabajo de saneamiento de datos de alto rendimiento en los que los equipos...

Octopii

Octopii root@kitploit: ⠀⠀⠀⠀⠀⠀⠀⣤⣤⣄⣀⡀⠀⠀⠀⢀⣠⣤⣤⣄⡀⠀⠀⠀⢀⣀⣠⣤⣤⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠸⣿⣿⡿⠿⢿⣷⡄⢠⣿⣿⣿⣿⣿⣿⡄⢀⣾⡿⠿⢿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠈⠉⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⣠⣤⡀⠀⠀⠀⠀⠀⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠀⠀⠀⠀⠀⢀⣤⣄⠀⠀⠀ ⠸⣿⣿⣿⣿⣿⣿⣿⣿⣦⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⣴⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀ ⠀⠉⠉⠁⠀⠀⠀⠀⣿⣿⠀⢸⣿⡇⠀⠉⣿⣿⣿⣿⠉⠀⢸⣿⡇⠀⣿⣿⠀⠀⠀⠀⠈⠉⠉⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣀⣈⣻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣟⣁⣀⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀...

Octopii

Octopii root@kitploit: ⠀⠀⠀⠀⠀⠀⠀⣤⣤⣄⣀⡀⠀⠀⠀⢀⣠⣤⣤⣄⡀⠀⠀⠀⢀⣀⣠⣤⣤⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠸⣿⣿⡿⠿⢿⣷⡄⢠⣿⣿⣿⣿⣿⣿⡄⢀⣾⡿⠿⢿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠈⠉⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⣠⣤⡀⠀⠀⠀⠀⠀⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠀⠀⠀⠀⠀⢀⣤⣄⠀⠀⠀ ⠸⣿⣿⣿⣿⣿⣿⣿⣿⣦⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⣴⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀ ⠀⠉⠉⠁⠀⠀⠀⠀⣿⣿⠀⢸⣿⡇⠀⠉⣿⣿⣿⣿⠉⠀⢸⣿⡇⠀⣿⣿⠀⠀⠀⠀⠈⠉⠉⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣀⣈⣻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣟⣁⣀⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀...

ODBParser

| ODBParser ---|--- TL;DR ODBParser is a tool to search for PII being exposed in open databases. ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance OR to query databases you have permission to access! PLEASE USE RESPONSIBLY What is this? Wrote thi...

pisiguard

PISIGuard Protege tu información personal y sensible cuando chateas con IA PISIGuard : P ersonally I dentifiable & S ensitive I nformation Guard Demo de PISIGuard: los datos sensibles se detectan, enmascaran y restauran directamente en el navegador Construí PISIGuard porque me horroriza cuánta...

Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...