CVE-2026-108577

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...

CVE-2026-108731

A flaw was found in raven. A missing authorization check allows an authenticated remote attacker to bypass the invite-only workspace restriction. By directly calling the workspace joining function, an attacker can gain unauthorized membership to invite-only workspaces, enabling them to read and...

gotestwaf

GoTestWAF GoTestWAF es una herramienta para la simulación de ataques a API y OWASP que soporta una amplia variedad de protocolos de API, incluyendo REST, GraphQL, gRPC, SOAP, XMLRPC, y otros. Fue diseñada para evaluar soluciones de seguridad de aplicaciones web, como proxies de seguridad de API,...

CVE-2026-108578 Neterbit NW-431F Embedded Web Server sms.json information disclosure

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

teatime

Teatime - Un Framework de Ataque RPC para Blockchain .. image:: https://img.shields.io/pypi/v/teatime.svg :target: https://pypi.python.org/pypi/teatime .. image:: https://img.shields.io/travis/dmuhs/teatime.svg :target: https://travis-ci.com/dmuhs/teatime .. image::...

CVE-2026-108760 LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API key...

CVE-2026-108748

Quarkus LangChain4j versions 1.9.0 through 1.14.1 are vulnerable to a memory exhaustion issue within the chat-scopes WebSocket /_chat/routes endpoint. The root cause is a missing release of memory where unauthenticated remote clients can send repeated CONNECT frames while reusing a single chatId ...

CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

CVE-2026-108736

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

CVE-2026-108721 Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...

CVE-2026-108575

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function getsecret of the file secretmanagers/main.py of the component Secret Resolution. The manipulation of the argument apikey leads to improper authorization. The attack can be initiated remotely. The exploit has...

DEBIAN-CVE-2026-108573

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

CVE-2026-108573

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

CVE-2026-108573

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

bbrecon

Este proyecto ya no recibe mantenimiento y he desconectado la infraestructura de rastreo. La audiencia no era lo suficientemente amplia como para justificar su mantenimiento. Bug Bounty Recon bbrecon es un servicio gratuito de Reconocimiento como Servicio para cazadores de bugs y investigadores d...

CVE-2026-108576

A critical OS command injection vulnerability exists in TOZED X300 (versions up to 6.01.3 ). The flaw is located within the process_ping function of the IPPingDiagnostics Handler component. An attacker can achieve remote code execution by manipulating the Host argument. The impact is severe, with...

EUVD-2026-96983

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...

netattack

NETATTACK El script netattack.py es un script en Python que te permite escanear tu área local en busca de redes WiFi y realizar ataques de desautenticación. La efectividad y potencia de este script depende en gran medida de tu tarjeta inalámbrica. NETATTACK 2 LANZADO...

certsync

certsync certsync es una nueva técnica para volcar NTDS de forma remota, pero esta vez sin DRSUAPI : utiliza golden certificate y UnPAC the hash. Funciona en varios pasos: 1. Volcar lista de usuarios, información de CA y CRL desde LDAP 2. Volcar certificado de CA y clave privada 3. Forjar fuera d...