1737 matches found
CVE-2026-6860
CVE-2026-6860 describes a TLS SNI handling weakness where a TCP client can present an SNI that matches a server wildcard certificate (e.g., *.example.com) and be accepted by the server, allowing any XYZ.example.com under the wildcard to be used. The CVSS 4.0 vector yields a NETWORK, LOW complexit...
CVE-2026-6860
A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting .example.com, any XYZ.example.com where xyz is a valid name can be used...
PT-2026-38262
Summary A flaw in Tauri's is local url function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://.localhost/ because those platforms' WebView implementations cannot serve custom URI...
DEBIAN-CVE-2026-40110
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match to check incoming origins against the alloworiginpat configuration value. Because re.match only anchors at the start of the string and does not require a...
JLSEC-2026-419 When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's...
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with host...
DNS Spider Multithreaded Bruteforcer 1.5
DNS Spider is a multi-threaded bruteforcer of subdomains that leverages a wordlist and/or character permutation...
v3nomEyE
The All-in-One P1 Bug Bounty Reconnaissance & Exploitation...
Subdomain Takeover Hint
Detect possible subdomain takeover indicators from DNS CNAME and HTTP fingerprints. from kittysploit import import json import dns.resolver from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Subdomain Takeover...
metasploit-web-scanner-module
MSF Web Vulnerability Scanner Advanced Advanced Metasploit au...
Advanced-AI-Recon-and-Exploit-Framework
reNgine: The Ultimate Web Reconnaissance & Vulnerability Scanner...
GHSA-M2M6-CFF5-3W7C RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions
Summary Server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. Impact An attacker who controls any origin the browser...
Black-Oracle
🖤 BLACK ORACLE 🖤 «The Eye That Sees Through Digital...
vulnscanx_v2
⚡ VulnScanX Advanced Vulnerability Scanning & Penetration...
reconauto
reconauto Automated b...
Exploit for Code Injection in Langflow
🎯 FlowBreaker CVE-2026-33017 — HTB-Style Pentest Lab...
auditor-v1
🔐 Web Security Auditor v2.0 Mini BurpSuite / OWASP ZAP hech...
golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs
A flaw was found in the crypto/x509 package in the Go standard library. This vulnerability allows a certificate validation bypass via an excluded subdomain constraint in a certificated chain as it does not restrict the usage of wildcard SANs in the leaf certificate...
IBM: SQL Injection found on ibm.com subdomain
A SQL injection vulnerability was identified on a subdomain, reported to the vendor, analyzed, and remediated...
golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs
A flaw was found in the crypto/x509 package in the Go standard library. This vulnerability allows a certificate validation bypass via an excluded subdomain constraint in a certificated chain as it does not restrict the usage of wildcard SANs in the leaf certificate...
golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs
A flaw was found in the crypto/x509 package in the Go standard library. This vulnerability allows a certificate validation bypass via an excluded subdomain constraint in a certificated chain as it does not restrict the usage of wildcard SANs in the leaf certificate...