CVE-2026-76748

A privilege escalation vulnerability exists in the API of AOS-S . An authenticated read-only user can successfully exploit this flaw to escalate their privileges and obtain administrative access to the affected system. The vulnerability has a CVSS 3.1 base score of 8.8 (High) . No specific techni...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...

EUVD-2026-93666

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-103620 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-103620

A missing authorization vulnerability in GitHub Enterprise Server allows repository collaborators with write access to delete the current default branch using the GraphQL API . This flaw enables an attacker to set an attacker-controlled branch as the new default. In repositories requiring pull-re...

CVE-2025-0868

Отчет по проекту тестирования на проникновение: эксплуатация CVE-2025-0868 DocsGPT RCE через JSON Eval 1. Введение Критическая уязвимость удаленного выполнения кода RCE CVE-2025-0868 была раскрыта 20 февраля 2025 года в библиотеке DocsGPT с открытым исходным кодом, вызванная небезопасным...

SecretFinder

à propos de SecretFinder SecretFinder est un script Python basé sur LinkFinder, conçu pour découvrir des données sensibles comme les clés API, jetons d'accès, autorisations, JWT, etc. dans les fichiers JavaScript. Il utilise jsbeautifier pour Python en combinaison avec une expression régulière...

EUVD-2026-93660

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...

CVE-2025-8625

CVE-2025-8625 Copypress Rest API 1.1 - 1.2 - Отсутствие настраиваемого секрета JWT и проверки типа файлов, ведущее к неаутентифицированному удалённому выполнению кода 🛡️ Copypress Rest API 1.1 - 1.2 RCE-эксплойт 📝 Описание Плагин Copypress Rest API для WordPress версии с 1.1 по 1.2 уязвим к...

AutoNessus

AutoNessus Ce script communique avec l'API Nessus pour aider à automatiser les scans. Selon le drapeau utilisé avec le script, vous pouvez lister tous les scans, lister toutes les politiques, démarrer, arrêter, mettre en pause et reprendre un scan. Il peut être utile de créer une tâche...

EUVD-2026-93611

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106422

Google Chrome versions prior to 155.0.8059.39 are vulnerable to an incorrect authorization flaw in an API. This vulnerability allows a remote attacker to bypass web origin policy by using a crafted HTML page. The security severity is rated as Low by Chromium. No specific exploit information is pr...

CVE-2026-106422

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

RedditC2

RedditC2 Abuser de l'API Reddit pour héberger le trafic C2, car la plupart des membres de l'équipe bleue utilisent Reddit, cela pourrait être un excellent moyen de rendre le trafic légitime. 🚫 Avertissement : L'utilisation de ce projet est réservée à des fins éducatives/de test. L'utiliser sur de...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106420

Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. Chromium security severity: Medium...