certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

kerberoast

🚩 Sponsors If you like this project, consider sponsoring it on GitHub! Sponsors kerberoast Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are th...

CVE-2026-96448

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

EUVD-2026-86588

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-96448 Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

paragon

Deprecation Notice This project has been deprecated, please refer to our new Realm project, which builds upon many of the ideas we had when building this repo. Paragon Paragon is a Red Team engagement platform. It aims to unify offensive tools behind a simple UI, abstracting much of the backend...

CVE-2025-51471-POC

CVE-2025-51471 - Ollama Cross-Domain Token Exposure PoC Author: ajtazer 🔥 Overview This repository contains a Proof of Concept PoC for CVE-2025-51471 , a Cross-Domain Authentication Token Exposure vulnerability that affects all versions of Ollama including the latest. 📋 Vulnerability Description...

Linux Distros Unpatched Vulnerability : CVE-2026-75973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and...

CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

EUVD-2026-85224

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-75973

Apache Tomcat is susceptible to an Improper Authentication vulnerability (CVE-2026-75973) when Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider. If multiple web applications utilize this provider, the realm from the first application to authenticate a req...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-18963_analyst

...

CVE-2026-27495

CVE-2026-27495 — Escape de sandbox en el Task Runner de JS de n8n Escape de sandbox en el Task Runner de JavaScript de n8n mediante una fuga de objetos del host-realm...

CVE-2026-94215

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94215 Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94215

Keycloak's Admin REST API contains a cross-realm privilege escalation flaw. The API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying realm ownership , allowing a limited-privilege administrator to read or modify client configurations in the master...

EUVD-2026-83841

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94215: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...