Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site...

PT-2026-107693

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A low-privileged user without admin or power roles can cause a denial of service against a REST API...

Linux Distros Unpatched Vulnerability : CVE-2026-106420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements...

Linux Distros Unpatched Vulnerability : CVE-2026-106422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...

CVE-2025-57231

CVE-2025-57231 - Docmost 0.22.0 - Произвольное чтение файлов Этот репозиторий содержит Proof of Concept PoC эксплойт для CVE-2025-57231. Отказ от ответственности Этот проект предоставлен исключительно в образовательных целях и для авторизованного тестирования безопасности. Не используйте его прот...

kyocera-cve-2022-1026

kyocera-cve-2022-1026 Неаутентифицированная уязвимость извлечения данных в принтерах Kyocera, позволяющая восстановить пароли адресной книги и пароли доменных учётных записей в открытом виде. Обзор уязвимости В 2021 году во время пентеста я экспериментировал с толстым клиентом Kyocera, используем...

CVE-2026-102407

A flaw was found in Elasticsearch. An authenticated user with permissions for at least one resource can exploit improper access controls in the Modify Data Streams application programming interface API to alter unauthorized data streams. Successful exploitation allows the user to inject data or...

dnsdmpstr

dnsdmpstr API et client non officiels pour DNS Dumpster et les outils IP de HackerTarget.com. https://dnsdumpster.com/ https://hackertarget.com/ip-tools/ Installation git clone https://github.com/zeropwn/dnsdmpstr cd dnsdmpstr pip3 install -r requirements.txt chmod +x ddump.py Utilisation En tant...

reconpal

ReconPal: Exploiter le NLP pour la Sécurité de l'Information La reconnaissance est l'une des phases les plus importantes qui semble facile mais qui demande beaucoup d'efforts et de compétences pour être bien réalisée. Il faut connaître les bons outils, les bonnes requêtes/syntaxes, exécuter ces...

autoresponder

AutoResponder Outil de réponse aux incidents Carbon Black Response pour la chasse aux menaces dans un environnement Qu'est-ce que c'est ? AutoResponder est un outil destiné à aider les personnes à effectuer leurs tâches de réponse aux incidents AVEC l'aide des capacités impressionnantes de Carbon...

gftrace

gftrace Un outil de traçage de l'API Windows en ligne de commande pour les binaires Golang. Note : Cet outil est une POC preuve de concept et un prototype en cours de développement, veuillez le traiter comme tel. Les retours sont toujours les bienvenus ! Comment ça fonctionne ? Bien que les...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache Cleartext Storage Vulnerability Description CVE-2023-5359 is a cleartext storage vulnerability affecting the WordPress plugin W3 Total Cache in versions ≤ 2.7.5. This vulnerability allows remote attackers to access sensitive credentials stored in unencrypted PHP fil...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-96594

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-97208

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-105268

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

csf

ArmourBird CSF - Framework de Sécurité des Conteneurs Remarque : Le client CSF est en cours de développement actif et est en train d'être converti en GoLang pour de meilleures performances et architecture. Table des matières 1. À propos 2. Diagramme d'architecture 3. APIs du serveur CSF 4...

kiterunner

Kiterunner Introduction Pendant très longtemps, la découverte de contenu s'est concentrée sur la recherche de fichiers et de dossiers. Bien que cette approche soit efficace pour les serveurs web legacy qui hébergent des fichiers statiques ou répondent avec des 3xx’s sur un chemin partiel, elle...

CVE-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...