reverseip_py

reverseippy Domain parser for IPAddress.com Reverse IP Lookup. Writen in Python 3. What is Reverse IP? Reverse IP refers to the process of looking up all the domain names that are hosted on a particular IP address. This can be useful for a variety of reasons, such as identifying all the websites...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116165

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHE...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

EUVD-2026-109451

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116193

Rclone versions 1.64.0 through 1.75.2 are vulnerable to an authentication bypass in the serve webdav functionality. The flaw allows unauthenticated attackers to bypass authentication by sending OPTIONS requests . By probing arbitrary paths and analyzing the Allow header values, attackers can dete...

CVE-2026-116165 Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHE...

php2shell

SIGiL PHP2Shell Scanner, 1.0.0-rc2 Consolidated release candi...

PT-2026-123034

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

p5-Starman -- multiple vulnerabilities

Starman project reports: SECURITY Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory CVE-2026-115824 Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 CVE-2026-115822 Do not send a response body...

POC-CVE-2023-32681

POC for CVE-2023-32681 This is a Python 3 implementation of CVE-2023-32681, affecting clients using the requests version = 2.30.0. As per https://www.rfc-editor.org/rfc/rfc9110.htmlsection-15.4 whenever redirection 3xx is issued by the server then user-agent should modify the request to remove...

lazyCSRF

LazyCSRF LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite. No longer maintenance🙇 When I started developing lazyCSRF, I mistakenly thought that the CSRF PoC generator built into Burp Professional could not generate PoC using XHR and did not support PUT requests, etc. I am stil...

SUSE CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsa...

EUVD-2026-108507

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server...

CVE-2026-46651

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket in goobi-viewer-core accepts download requests from unauthenticated users...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the...