kanidm

Kanidm - Simple and Secure Identity Management About Kanidm is a simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm. The goal of this project is to be a complete identity provider,...

CVE-2022-28346

CVE-2022-28346 Inyección SQL en QuerySet.annotate, aggregate y extra Configuración: Ejecuta ./setup.sh para la configuración inicial Abre la imagen de Docker para iniciar la base de datos: docker exec -it containerid /bin/bash Y ejecuta los siguientes comandos: root@kitploit: python manage.py...

LangAlpha

Un arnés de agente para inversiones por vibra «vibe investing» LangAlpha está diseñado para ayudar a interpretar los mercados financieros y respaldar decisiones de inversión. English ｜ 简体中文 ｜ 日本語 Primeros pasos • API Docs • Agent Core • Backend • Web • TUI • Skills • MCP Fija en el panel un resum...

jdam

jdam - Fuzzing JSON consciente de la estructura jdam es una herramienta inspirada en Radamsa para fuzzear objetos JSON arbitrarios de manera consciente de la estructura, lo que garantiza que los resultados del fuzzing siempre sean JSON válido. Muchas herramientas de fuzzing existentes alteran...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

polypyus

Polypyus Firmware Historian Polypyus learns to locate functions in raw binaries by extracting known functions from similar binaries. Thus, it is a firmware historian. Polypyus works without disassembling these binaries, which is an advantage for binaries that are complex to disassemble and where...

CVE-2026-92405

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-87031

n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint POST /ccm/api/1.0/users, the add method of concrete/src/Api/Controller/Users.php did not perform a permission check before creating an account. As a result, any valid OAuth token carrying the users:add scope, including a...

CVE-2026-85756

SSH.NET is a Secure Shell SSH library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an...

CVE-2026-84993

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field key of an orderBy clause but does not validate its direction value before AbstractSqlPlatform.getOrderByExpression concatenate...

CVE-2026-76420

A vulnerability in the internal configuration of the Apache JServ Protocol AJP connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector...

SOC-L1-OSINT-Investigation-MikroTik-CVE-2018-1156

SOC L1 Threat Investigation: MikroTik RouterOS Multiple Exposed Services Analyst: Jonatan Alexander Guerrero Gomez | Role Target: SOC L1 / Jr. Cybersecurity Analyst Status: Investigation Closed | Severity: High Executive Summary Proactive threat hunting exercise indentifying a public-facing...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

Complete-google-dorks

Complete-google-sql-dorks news/news.php?id= -site:php.net -"The PHP Group" inurl:source inurl:url ext:pHp !Host=. intext:encUserPassword= ext:pcf ?action= ?cat= ?id= ?intitle:index.of? mp3 artist-name-here ?intitle:index.of? mp3 name ?page= ?pagerequested= ?pid= " -FrontPage-" ext:pwd inurl:servi...

AFLplusplus

American Fuzzy Lop plus plus AFL++ 发布版本：5.03c GitHub 版本：5.03c 仓库： https://github.com/AFLplusplus/AFLplusplus AFL++ 由以下人员维护： Marc "van Hauser" Heuse [email protected] Dominik Maier [email protected] Andrea Fioraldi [email protected] Heiko "hexcoder-" Eissfeldt [email protected]...

CVE-2026-59944

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-59974

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating...

CVE-2026-57173

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

CVE-2026-20307

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative...

CVE-2026-20306

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. Th...