@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

GHSA-RQX4-3F6Q-3X2V @Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

Exploit for CVE-2026-89012

CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass Exploit...

recon-ninja

recon-ninja La herramienta es un repositorio de GitHub que proporciona una herramienta de reconocimiento que te permite subir el descubrimiento de tus dominios mediante una opción de carga. La herramienta utiliza HTTPX, una herramienta que escanea dominios vivos. La herramienta también tiene...

GHSA-65H7-9WRW-629C FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

CollaRE

CollaRE v1.4 Introduction CollaRE is a tool for collaborative reverse engineering that aims to allow teams that do need to use more then one tool during a project to collaborate without the need to share the files on a separate location. It also contains a very simple user management and as such...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE. root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host...

ROOT-OS-DEBIAN-12-CVE-2026-43660 CVE-2026-43660 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43660 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43725 CVE-2026-43725 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43725 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28953 CVE-2026-28953 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28953 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28902 CVE-2026-28902 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28902 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43715 CVE-2026-43715 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43715 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28847 CVE-2026-28847 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28847 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43705 CVE-2026-43705 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43705 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-4367 CVE-2024-4367 in webkit2gtk - Patched by Root

Root has patched CVE-2024-4367 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28907 CVE-2026-28907 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28907 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28942 CVE-2026-28942 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28942 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

GHSA-H8M9-JGF8-VWVP Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

SAML Tenant Binding Enables Cross-Tenant Account Takeover Summary Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a self-controlled IdP could...

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

SAML Tenant Binding Enables Cross-Tenant Account Takeover Summary Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a self-controlled IdP could...