PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

CVE-2026-88805

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-88804

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18...

CVE-2026-101077

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function processrequest of the component boatemp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contact...

CVE-2026-101078

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-101080

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skillscan/tools/dir/diractions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly...

CVE-2026-101076

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...

EUVD-2026-88345

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menunatmoreasp of the file menunatmore.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched...

CVE-2026-101081

The D-Link DI-8400 running firmware version 16.07 is vulnerable to a stack-based buffer overflow in the Web Administration Service . The flaw exists within the menu_nat_more_asp function of the menu_nat_more.asp file, where manipulating the opt argument can trigger the overflow. This vulnerabilit...

CVE-2023-54397

A flaw was found in Tornado's HTTP request header parsing logic. When processing incoming HTTP requests, Tornado fails to reject malformed Content-Length headers containing non-standard characters. An unauthenticated remote attacker can exploit this parsing discrepancy when Tornado is deployed...

CVE-2026-86350

A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security...

cbrutekrag

cbrutekrag Pruebas de penetración en servidores SSH mediante ataques de diccionario. Escrito en C. brute krag significa "fuerza bruta" en afrikáans Descargo de responsabilidad Esta herramienta es solo para fines de pruebas éticas. cbrutekrag y sus propietarios no se hacen responsables por el uso...

CVE-2026-78383

A flaw was found in Apache Tomcat. An unauthenticated remote attacker can send a specially crafted AJP Apache JServ Protocol request, causing an AJP processing thread to become unresponsive. This resource exhaustion can lead to a denial of service DoS, making the server unavailable to legitimate...

brutemap

Brutemap .. image:: https://brutemap-dev.github.io/static/brutemap-logo.jpg :target: https://brutemap-dev.github.io :alt: Logotipo de Brutemap |Build Status| |Python| |License| .. |Build Status| image:: https://travis-ci.org/brutemap-dev/brutemap.svg?branch=master :target:...

brutemap

Brutemap .. image:: https://brutemap-dev.github.io/static/brutemap-logo.jpg :target: https://brutemap-dev.github.io :alt: Brutemap Logo |Build Status| |Python| |License| .. |Build Status| image:: https://travis-ci.org/brutemap-dev/brutemap.svg?branch=master :target:...

CVE-2019-19652

CVE-2019-19652 Chevereto downgrade attack - 1.0.0 - 1.1.4 Free, = 3.13.5 Core. An admin user can instruct the updater script to downgrade to another version instead of upgrade, reintroducing previous flaws. Due to the lack of a CSRF token this attack can also be used in a CSRF attack, meaning an...

CVE-2020-0796-LPE

CVE-2020-0796-LPE Escalada de privilegios local SMBGHOST https://github.com/ZecOps/CVE-2020-0796-LPE-POC https://github.com/danigargu/CVE-2020-0796...

EUVD-2026-88341

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skillscan/tools/dir/diractions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly...

CVE-2026-101080

A path traversal vulnerability exists in the File Access component of Tencent AI-Infra-Guard (versions up to 4.5.2 and 4.6.2). The flaw is located within the startsWith function of the file skill_scan/tools/dir/dir_actions.py. This issue requires local access to exploit. The documents state that ...

cheetah

English description | 中文说明 0x00 cheetah Cheetah is a dictionary-based brute force password webshell tool, running as fast as a cheetah hunt for prey. Cheetah's working principle is that it can submit a large number of detection passwords based on different web services at once, blasting efficienc...