CVE-2026-106308

Google Chrome on Android versions prior to 155.0.8059.39 is vulnerable to a High severity security issue caused by an incorrect reference resolution in the Autofill component. A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page , which can then be u...

CVE-2026-106245

Google Chrome versions prior to 155.0.8059.39 are vulnerable to a high-severity security issue caused by an uninitialized resource in the ANGLE component. A remote attacker can exploit this vulnerability by using a crafted HTML page to obtain cross-origin data . Remediation is available in versio...

CVE-2026-106245

Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

EUVD-2026-93798

Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

ImproHound

ImproHound 识别破坏AD分层结构的BloodHound攻击路径 ImproHound 是一个带有图形界面的 dotnet 独立 Windows x64 可执行文件。 要使用 ImproHound，您必须运行 SharpHound 从 AD 收集必要的数据。然后将数据上传到您的 BloodHound 安装实例。ImproHound 会连接到 BloodHound 底层的 Neo4j 数据库。在 ImproHound 中，您将通过 OU 结构将 AD 对象分为不同的层级，ImproHound 将识别出允许 AD 对象危及更高（更接近零）层级对象的 AD 关系，并将层级违规保存到 C...

RTA

Red Team Arsenal Red Team Arsenal 是 Flipkart 安全团队创建的内部框架，用于监控公司在线资产的外部攻击面，并提供任何安全异常的整体安全 视图。它紧密集成了多种安全引擎和工具，用于实施/模拟攻击，并监控面向公众的资产是否存在异常和泄漏。 这是一个智能框架，用于检测所有第七层（应用层）资产的安全异常并进行报告。 随着公司通过收购和地理扩张不断扩大其在互联网上的足迹，人工驱动的安全工程已不可扩展，因此，公司需要反馈驱动的自动化系统来保持稳定。 安装 支持的平台 RTA 已在 Ubuntu/Debian （基于 apt-get 的发行版）上测试通过，也适...

pentest-a2p2v-core

README 自动化攻击路径规划与验证（A2P2V）是一款规划与网络攻击工具，能够根据特定攻击者目标，为用户提供一组排序后的攻击序列。该工具旨在简化流程，使非安全专家也能通过尽可能自动化的基本输入，生成清晰、可操作的威胁情报，并产出易于解读的报告。 该系统利用已知网络拓扑和系统漏洞信息，确定所有能够达成攻击者目标的攻击序列，并为所选序列输出所需步骤（以 Metasploit 命令形式）。 系统输入包括： 初始条件 ：对攻击者当前知识与访问权限进行建模 攻击者目标 ：指示状态变化（例如改变 ICS 系统的温度）或远程访问特定目标主机 漏洞信息 ：Nessus 或 Nmap...

pentest-a2p2v-core

README Automated Attack Path Planning and Validation A2P2V is a planning and cyber-attack tool that provides the capability for users to determine a set of ranked attack sequences given a specific attacker goal. The aim of the tool is to simplify process so that non-security experts can generate...

CVE-2026-55307

A logic error in the kdn_set_sysregs_prot function within the hwcrypto-kdn.c file can lead to a local information disclosure . Exploitation of this vulnerability requires System execution privileges , and no user interaction is required. While the technical impact is classified as partial, the co...

AWS-Tough-Library-Multiple-CVEs

AWS Tough Library: Múltiples CVEs En marzo de 2025 se revelaron múltiples vulnerabilidades de seguridad en la librería Tough de AWS Labs una implementación cliente en Rust de TUF – The Update Framework. Estos problemas están registrados como CVE-2025-2885, CVE-2025-2886, CVE-2025-2887 y...

CVE-2026-105485

The Devolutions Server (version 2026.3.7.0 and earlier) is susceptible to an authentication bypass within the OAuth device authorization flow . A remote attacker can achieve full account takeover of an authenticated victim by replaying a captured device verification link . The vulnerability is ca...

EUVD-2026-93782

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...

CVE-2026-105485

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...

CVE-2026-9226

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

CVE-2026-9226

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

CVE-2026-88252

A flaw was found in sssd. A local user can cause a Denial of Service DoS by exhausting the responder service's available file descriptors system handles used for open connections. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection...

CVE-2026-106105

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only...

EUVD-2026-93778

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This...

payloads

payloads Git All the Payloads! Una colección de payloads de ataques web. ¡Las pull requests son bienvenidas! Uso ejecuta ./get.sh para descargar payloads externos y descomprimir cualquier archivo de payload que esté comprimido. Créditos de payloads fuzzdb - https://github.com/fuzzdb-project/fuzzd...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...