311154 matches found
ditto
Ditto es una pequeña herramienta que acepta un nombre de dominio como entrada y genera todas sus variantes para un ataque homográfico como salida, verificando cuáles están disponibles y cuáles ya están registrados. Dominios PoC https://tᴡitter.com/ https://clᴏudflare.com Usando con Docker La imag...
pig
Pig Pig que puede entenderse como Packet intruder generator es una herramienta de creación de paquetes para Linux. Puedes usar Pig para probar tu IDS/IPS, entre otras cosas. Pig incluye un conjunto de firmas de ataque conocidas listas para usar y puedes ampliar esta colección con cosas más...
CVE-2026-108863 Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...
CVE-2026-108860 BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...
CVE-2026-108860 BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...
CVE-2026-108748
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...
CVE-2026-108736
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...
CVE-2026-108721
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...
DEBIAN-CVE-2026-108577
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...
AZL-108056 CVE-2026-108577 affecting package libmodplug 0.8.9.0-12
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...
CVE-2026-108576
A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...
CVE-2026-108577
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...
CVE-2026-108731
A flaw was found in raven. A missing authorization check allows an authenticated remote attacker to bypass the invite-only workspace restriction. By directly calling the workspace joining function, an attacker can gain unauthorized membership to invite-only workspaces, enabling them to read and...
gotestwaf
GoTestWAF GoTestWAF es una herramienta para la simulación de ataques a API y OWASP que soporta una amplia variedad de protocolos de API, incluyendo REST, GraphQL, gRPC, SOAP, XMLRPC, y otros. Fue diseñada para evaluar soluciones de seguridad de aplicaciones web, como proxies de seguridad de API,...
CVE-2026-108578 Neterbit NW-431F Embedded Web Server sms.json information disclosure
A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...
teatime
Teatime - Un Framework de Ataque RPC para Blockchain .. image:: https://img.shields.io/pypi/v/teatime.svg :target: https://pypi.python.org/pypi/teatime .. image:: https://img.shields.io/travis/dmuhs/teatime.svg :target: https://travis-ci.com/dmuhs/teatime .. image::...
CVE-2026-108760 LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API key...
CVE-2026-108748
Quarkus LangChain4j versions 1.9.0 through 1.14.1 are vulnerable to a memory exhaustion issue within the chat-scopes WebSocket /_chat/routes endpoint. The root cause is a missing release of memory where unauthenticated remote clients can send repeated CONNECT frames while reusing a single chatId ...
CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...
CVE-2026-108736
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...