CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

CVE-2026-50554

Note Mark (open-source note-taking application) is vulnerable to unauthenticated disclosure of soft-deleted note metadata prior to v0.19.5 . The unauthenticated GET /api/books/{bookID}/notes endpoint accepts a deleted query parameter; when set to true, the service calls Unscoped() to bypass GORM'...

CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory

Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. "Unlike the standard infostealer model, BraZetsu is a comprehensive master toolkit that...

nmapAutomator

nmapAutomator バックグラウンドで実行できるスクリプト！ 概要 このスクリプトの主な目的は、毎回実行される列挙と偵察のプロセスを自動化し、代わりに実際のペネトレーションテストに集中できるようにすることです。 これにより、次の2つが保証されます： 1. nmapスキャンを自動化します。 2. 常にバックグラウンドで何らかの偵察を実行しておくこと。 最初のポートが '5〜10秒以内 ' に見つかったら、それらのポートを手動で調査し始め、残りはこちらからの操作を一切行わずにバックグラウンドで実行させることができます。 機能 スキャン 1. Network :...

RootPipeTester

目次 1. RootPipe Testerとは何か？ 2. なぜRootPipe Testerを使うべきか？ 3. RootPipe Testerはどう使うのか？ 4. パニック!!! 私のシステムは脆弱なの？ 私たちはみんな死ぬの？ 1. OS X 10.10 Yosemite 2. OS X 10.9 Mavericks 3. OS X 10.8 Mountain Lion 4. OS X 10.7 Lion, Mac OS X 10.6 Snow Leopard, Mac OS X 10.5 Leopard, Mac OS X 10.4 Tiger 5. Mac OS X 10.3...

CVE-2022-26923

CVE-2022-26923 如 Tenable 所述：Active Directory 域服务权限提升漏洞 CVSS v3 基础评分：8.8 向量：CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 严重性：高危 摘要： CVE-2022-26923 利用了 Microsoft Active Directory 证书服务（AD CS）中的漏洞来提升权限。 证书模板：AD CS 为证书请求提供两个默认模板：用户（User）和计算机（Machine）。 用户模板限制：用户模板不易受到攻击，因为它将用户的 UPN 嵌入到 SAN 中，而 UPN...

waybackpack

waybackpack Waybackpack is a command-line tool that lets you download the entire Wayback Machine archive for a given URL. For instance, to download every copy of the Department of Labor's homepage through 1996 which happens to be the first year the site was archived, you'd run: root@kitploit:...

lighty-sqlinj-demo

title: Ep4 - ネットワーク関連の脆弱性 members: Ciro S. Costa Marcela Terakado date: 10 Nov, 2015 関連脆弱性: root@kitploit: CVE-2014-2323 1 was assigned to SQL injection bug. CVE-2014-2324 2 was assigned to the path traversal bug. 確認: http://download.lighttpd.net/lighttpd/security/lighttpdsa201401.txt 影響バージョン:...

XXEinjector

XXEinjector XXEinjector は、直接および Out of Band 方式を使用したファイル取得を自動化します。ディレクトリリストは Java アプリケーションでのみ機能します。他のアプリケーションでは、ブルートフォース方式を使用する必要があります。 オプション: root@kitploit: --host Mandatory - our IP address for reverse connections. --host=192.168.0.2 --file Mandatory - file containing valid HTTP request with xml...

DVDR_LLM

DVDR-LLM: ソフトウェア脆弱性の検出と修復において、LLMはいつ協調するとより優れているのか？ 研究論文の公式実装およびアーティファクト： 「DVDR-LLM: ソフトウェア脆弱性の検出と修復において、LLMはいつ協調するとより優れているのか？」 🎯 概要...

CVE-2026-85226

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

CVE-2026-85213

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server b...

CVE-2026-85210

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...

CVE-2026-85212

CRMEB contains an authentication bypass vulnerability in the verifyAuth method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits...

CVE-2026-85214

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial...

CVE-2026-85181

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-85182

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

CVE-2026-85177

CRMEB through 6.0.0 fails to validate message ownership in the editmessage handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including isdel, look, and uid to delete, mark read, or reassign...