CVE-2026-108264

Wizarr, a management system for media servers like Jellyfin and Plex, is vulnerable to Server-Side Template Injection (SSTI) prior to version 2026.9.1 . The issue exists because wizard step Markdown—provided via the editor or imported bundles—is evaluated in a non-sandboxed Jinja2 environment wit...

CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

Vikunja: TOTP secret is readable after enrollment, no step-up auth

Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...

CVE-2026-33272

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

EUVD-2026-95815

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

nuclei-burp-plugin

Nuclei Template Generator Burp Plugin A Burp Suite plugin intended to help with nuclei template generation. Features Template matcher generation Word and Binary matcher creation using selected response snippets from Proxy history or Repeater contexts Multi-line selections are split to separate...

systeminformer

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc...

CVE-2026-85348

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

HardeningKitty

HardeningKitty Ceci est la version stable de HardeningKitty du projet Windows Hardening de Michael Schneider. La version stable de HardeningKitty est signée avec le certificat de signature de code de scip AG. Puisqu'il s'agit de la version stable, nous n'acceptons pas les pull requests dans ce...

EUVD-2026-95706

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

WhatsApp-OSINT

WHATS OSINT 🕵️‍♂️ Outil OSINT pour WhatsApp qui vous permet d'obtenir des photos de profil, de vérifier les comptes Business, de consulter le statut et les informations utilisateur, d'analyser les appareils liés, de vérifier les paramètres de confidentialité et d'accéder aux données complètes via...

MsSettingsDelegateExecute

MsSettingsDelegateExecute Contournement de l'UAC sur Windows 10/11 x64 à l'aide de la clé de registre DelegateExecute de ms-settings. Ce projet Visual Studio compilera un binaire x64 statique pour tester ce problème. Licence Ces fichiers sont disponibles sous la licence BSD à 3 clauses...

surf

Surf - Escalate your SSRF vulnerabilities on Modern Cloud Environments surf allows you to filter a list of hosts, returning a list of viable SSRF candidates. It does this by sending a HTTP request from your machine to each host, collecting all the hosts that did not respond, and then filtering th...

tachyon

Tachyon Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl a web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.6+ User Installation...

user.js

Ce dépôt et la page web interactive liée ci-dessous sont les seules sources officielles - ne faites confiance à aucun autre site prétendant être Arkenfox 🟪 user.js Un user.js est un fichier de configuration qui peut contrôler les paramètres de Firefox - pour une analyse et une explication plus...

CVE-2019-19651

CVE-2019-19651 XSS réfléchi dans Chevereto via le nom du site, le doctitle et la description - 1.0.0 - 1.1.4 Free, Paramètres - Nom du site, Doctitle du site, Description du site L'insertion de ceci se réfléchira sur l'ensemble du site pour tous les utilisateurs "Chevt dans l'en-tête, vous pouvez...

EUVD-2026-95523

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

CVE-2026-88931

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to an unauthenticated arbitrary plugin settings update . The root cause is a failure to restrict which settings can be modified via an unauthenticated endpoint. This allows an attacker to overwrite arbitrary plugin opt...

CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...