vault

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

EntraFalcon

EntraFalcon EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment. Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

EUVD-2026-116800

IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality...

authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

TaskHound

Windows Privileged Scheduled Task Discovery Tool for fun and profit. TaskHound hunts for Windows scheduled tasks that run with privileged accounts and stored credentials. It enumerates tasks over SMB, parses XMLs, and identifies high-value attack opportunities through BloodHound integration. For...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

zBang

zBang is a special risk assessment tool that detects potential privileged account threats in the scanned network. Organizations and red teamers can utilize zBang to identify potential attack vectors and improve the security posture of the network. The results can be analyzed with the graphic...

CVE-2026-121101

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-121085

Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-120715

Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request...

EUVD-2026-116344

Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121085

A vulnerability in the WebUI of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass system access restrictions. By using a crafted HTML page , an attacker can gain access to a privileged page due to incorrect authorization (CWE-863). The reported security severity is L...

EUVD-2026-116334

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-121101

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-121101

Google Chrome versions prior to 157.0.8103.38 are vulnerable to a missing authorization flaw in DevTools . A remote attacker can leverage social engineering to bypass system access restrictions and reach a privileged page through a crafted Chrome extension . The security severity is rated as Low ...

CVE-2026-121031

Google Chrome versions prior to 157.0.8103.38 are vulnerable to a missing authorization flaw in the PDF component. This issue allows a remote attacker to bypass the web origin policy to access a privileged page using a crafted Chrome extension . Remediation is available in version 157.0.8103.38 a...

CVE-2026-95770

A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met. Successful...

CVE-2026-95744

A sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allo...

CVE-2026-95730

A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected system...