12802 matches found
catalyst
Catalyst Speed up your reactions Website - The Catalyst Handbook Documentation - Demo Catalyst is an incident response platform. It can help to automate your alert handling and incident response procedures. Features Ticket Alert & Incident Management Tickets are the core of Catalyst. They...
TileServer API - Cross Site Scripting
tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting XSS vulnerability via the component /data/v3/?key. id: CVE-2024-35627 info: name: TileServer API - Cross Site Scripting author: DhiyaneshDK severity: medium description: | tileserver-gl up to v4.4.10 was discovered to...
Cost Calculator Builder <= 3.2.15 - SQL Injection
The Cost Calculator Builder plugin for WordPress is vulnerable to SQL Injection via discount codes in versions up to, and including, 3.2.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
bbrecon
This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...
Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of GetFileWithoutZip method. The issue results from th...
tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up
A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security...
tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up
A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security...
CVE-2026-58915
A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...
CVE-2026-58915
A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...
CVE-2026-58915
A physical occupant of an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N ) without authentication. The root cause is a bypass of the PassengerKeyguard ; t...
EUVD-2026-115617
A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...
CVE-2026-58915: Google Android: A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view…
A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...
PT-2026-135801
A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...
CVE-2026-120263 Gitea OAuth2 account auto-linking takeover through the sign-up form
When oauth2client.ACCOUNTLINKING is set to auto not the default and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on...
CVE-2026-120263 Gitea OAuth2 account auto-linking takeover through the sign-up form
When oauth2client.ACCOUNTLINKING is set to auto not the default and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on...
CVE-2026-120263
The Gitea platform is vulnerable to an authorization bypass and account takeover when [oauth2_client].ACCOUNT_LINKING is set to auto and registration is enabled. The vulnerability exists because the link-account sign-up form identifies accounts to link using the username or email submitted in the...
ActiveMQ-RCE-CVE-2023-46604-Write-up
This repository does not have a README...
CVE-2025-7404-CalibreWeb-0.6.24-BlindCommandInjection
CVE-2025-7404-CalibreWeb-0.6.24-BlindCommandInjection CVE-2025-7404 exploit...