Nuclei 3.11.0

Nuclei is a modern, high-performance vulnerability scanner that leverages simple YAML-based templates. It empowers you to design custom vulnerability detection scenarios that mimic real-world conditions, leading to zero false positives...

Slate Digital Connect 1.37.0 Security Scanner

This Python script is a local security scanner designed to detect potential exposure related to Slate Digital Connect and its components associated with CVE-2026-24066 and CVE-2026-24067...

SAP NetWeaver SAML Endpoint Exposure Scanner Tool for Metadata Discovery

This Python script is a defensive security scanner designed to identify exposed SAML-related endpoints on SAP NetWeaver systems SAPBASIS versions 700–918...

Strapi CMS 5.36.1 Security Misconfiguration Detection Scanner

This is a scanner designed to identify potential security misconfigurations in Strapi CMS instances without performing exploitation or data extraction...

CVE-2026-25271: Time-of-check Time-of-use (TOCTOU) Race Condition

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use...

CVE-2026-25268: Stack-based Buffer Overflow

Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations...

CVE-2026-21384: Out-of-bounds Write

Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits...

CVE-2026-21383: Reusing a Nonce, Key Pair in Encryption

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security...

CVE-2026-21379: Buffer Over-read

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value...

CVE-2026-21370: Out-of-bounds Write

Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values...

CVE-2026-21369: Out-of-bounds Write

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification...

CVE-2026-21368: Out-of-bounds Write

Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks...

CVE-2025-59617: Use After Free

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input...

CVE-2025-59615: Use After Free

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization...

CVE-2026-48316: Improper Input Validation

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2025-53830: Server-Side Request Forgery (SSRF)

Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for ownCloud before 1.2.3 are vulnerable to Server-Side Request Forgery SSRF. This corresponds to versions of ownCloud 10 prior to 10.15.3. Upgrade...

CVE-2026-6901: Untrusted Search Path

Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5...

CVE-2026-6900: Improper Certificate Validation

Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5...

CVE-2026-12686: Authorization Bypass Through User-Controlled Key

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

CVE-2025-8591: Improper Neutralization of Input During Web Page Generation

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can...