s3-leaks

s3-leaks List of AWS S3 Leaks Feel free to send in a PR if you know of other leaks...

BlobHunter

BlobHunter An opensource tool for scanning Azure blob storage accounts for publicly opened blobs. BlobHunter is a part of Hunting Azure Blobs Exposes Millions of Sensitive Files research. Overview BlobHunter helps you identify Azure blob storage containers which store files that are publicly...

goblob

Goblob 🫐 Goblob es una herramienta de enumeración ligera y rápida diseñada para ayudar en el descubrimiento de información sensible expuesta públicamente en blobs de Azure, lo cual puede ser útil para diversos fines de investigación como evaluaciones de vulnerabilidades, pruebas de penetración y...

SOC-L1-OSINT-Investigation-MikroTik-CVE-2018-1156

Investigación de Amenazas SOC L1: Múltiples Servicios Expuestos en MikroTik RouterOS Analista: Jonatan Alexander Guerrero Gomez | Rol Objetivo: SOC L1 / Analista de Ciberseguridad Jr. Estado: Investigación Cerrada | Severidad: Alta Resumen Ejecutivo Ejercicio proactivo de caza de amenazas que...

CVE-2026-86543 knowns before 0.30.0 Unauthenticated Management API Exposure

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

CVE-2026-86543

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. An unauthenticated attacker can access the /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publi...

PT-2026-86936

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

DRUPAL-CONTRIB-2026-129

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2025-13394 Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2026-18602

creationtimestamp| type| source ---|---|--- 2026-08-04 16:00:44+00:00| seen| https://www.acn.gov.it/portale/w/gl-inet-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-18601-cve-2026-18602-cve-2026-18612-cve-2026-18616 2026-08-05 01:00:34+00:00| seen|...

PT-2026-66766

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

GO-2026-6063 Gitea: REST API exposes organization membership of private organizations to public in gitea.dev

Gitea: REST API exposes organization membership of private organizations to public in gitea.dev...

CVE-2023-54366

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations o...

CVE-2026-49211

Symfony UX Autocomplete vulnerable in versions 2.2.0–2.35.0 and 3.1.0 where addSearchClause() builds LIKE literals with client input wrapped in %...%, without escaping %, _, or , allowing unauthenticated users to turn BaseEntityAutocompleteType into a broad matcher across default searchable_field...

CVE-2026-59720

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without...

CVE-2026-59720 Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without...

CVE-2026-59720

Hoppscotch’s Mock API exposes private collection data due to a desync: mock-server.service.ts does not persist the isPublic input, while schema.prisma defaults isPublic to true, making mock servers linked to private collections publicly accessible without authentication. The vulnerability affects...

CVE-2026-59720 Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without...