CVE-2026-85392

Peppermint (through version 0.5.5) contains an authorization bypass in the GET /api/v1/auth/user/:id/logout API endpoint. The endpoint performs no check to verify the caller owns the target account, allowing any authenticated attacker to supply an arbitrary user ID and forcibly delete that user's...

CVE-2026-85392 Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling...

CVE-2026-85390

Checkmate through 3.11.0 omits the isAllowed role guard middleware on its maintenance-window, notification, and check-deletion routes, allowing users with a read-only role to perform administrative actions. A low-privileged attacker with a valid user-role session can create arbitrary maintenance ...

CVE-2026-85389

Worklenz before 3.0.0 suffers from an authorization bypass on task-scoped API endpoints due to missing verification of task ownership by organization. Authenticated users can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belongin...

CVE-2026-85389 Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...

EUVD-2026-70667

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

CVE-2026-85389 Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...

EUVD-2026-70666

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...

CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

nikto

nikto Nikto web server scanner - https://cirt.net/Nikto2 Full documentation - https://github.com/sullo/nikto/wiki Run normally: root@kitploit: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.co...

Lime-RAT

旧式です。削除する代わりにアーカイブしてください LimeRAT v0.1.9 Windows 用リモート管理ツール 説明 Windows マシン向けのシンプルかつ強力な RAT です。このプロジェクトはシンプルで理解しやすく、dotNET マルウェアとその動作についての一般的な知識を得られるはずです。 主な機能 .NET Visual Basic .NET で記述。クライアントは Framework 2.0 または 4.0 に依存し、サーバーは 4.0 です。 接続 ip:port として noip.com DNS の代わりに pastebin.com...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Authorization (CVE-2026-33186)

Summary There are vulnerabilities in google.golang.org/grpc-v1.78.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33186. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions pri...

Security Bulletin: MongoDB Enterprised Advanced affected by: Path Traversal (CVE-2026-39406)

Summary There are vulnerabilities in node-server-1.19.11.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39406. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39406 DESCRIPTION: @hono/node-server allows running the Hono application on Node.js. Prio...

reproxy

Reproxy is a simple edge HTTPs server / reverse proxy supporting various providers docker, static, file, consul catalog. One or more providers supply information about the requested server, requested URL, destination URL, and health check URL. It is distributed as a single binary or as a docker...

Security Bulletin: MongoDB Enterprised Advanced affected by: CRLF Injection (CVE-2026-39983)

Summary There are vulnerabilities in basic-ftp-5.2.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39983. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39983 DESCRIPTION: basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows F...

Security Bulletin: MongoDB Enterprised Advanced affected by: Allocation of Resources Without Limits or Throttling (CVE-2026-35469)

Summary There are vulnerabilities in github.com/moby/spdystream-v0.5.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-35469. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-35469 DESCRIPTION: spdystream is a Go library for multiplexing streams over SPD...

davscan

DAVScan DAVScanは、WebDAVが有効なウェブサーバ上で隠しファイルやフォルダを発見するために設計された、高速かつ軽量なWebDAVスキャナです。 このスキャナは、過度に特権が設定されたり誤設定されたWebDAVサーバや、さまざまな情報漏洩や認証バイパスの脆弱性があるサーバを悪用することで動作します。スキャナは対象サーバのフィンガープリントを取得し、ルートのPROPFINDリクエストの結果に基づいてサーバをクロールします。 注意点: もし私の酷いコードを実際に読む時間を取るなら、davscanの中核部分をBeautiful...

martian

Martian Proxy Martian Proxy は、テスト用に設計されたプログラム可能な HTTP プロキシです。 Martian は、以下のことを行いたい場合に最適なツールです: すべてのまたは一部のリクエストが安全であることを検証する ネットワーク層で外部サービスをモックする ヘッダーの注入、クッキーの変更、または HTTP リクエストとレスポンスに対するその他の変更を実行する ピングバックが期待どおりのタイミングで発生することを検証する 暗号化されたトラフィックを復号するブラウザへの CA 証明書のインストールが必要 Go のクロスコンパイルを活用することで、Martian...

evine

Evine Interactive CLI Web Crawler. Evine is a simple, fast, and interactive web crawler and web scraper written in Golang. Evine is useful for a wide range of purposes such as metadata and data extraction, data mining, reconnaissance and testing. If you like the project, give it a star. It forces...