chameleon

19 Customizable honeypots for monitoring network traffic, bots activities, and username\password credentials DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres, MySQL, MSSQL, Elastic and ldap If you want to implement the honeypots in your project,...

stop-bots

Stop Bots A TUI and a CLI that help you configure your server to stop bad bots without hiding behind a CDN. It is a fancy UI for your existing web server nginx, Apache, Traefik or NPMplus and your firewall nftables or iptables. For those of us that don't want to hide behind Cloudflare and give on...

CVE-2026-123520

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering...

EUVD-2026-119405

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering...

CVE-2026-123520 Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering...

CVE-2026-123520 Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering...

CVE-2026-123520

The software Vikunja versions 0.18.0 before 2.7.1 contains a privilege escalation vulnerability caused by improper handling of account deletions. Specifically, an attacker with team owner privileges can create a bot, add it to their team, and delete it via the bots endpoint. This action triggers ...

PT-2026-139801

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering...

CVE-2026-123520: go-vikunja vikunja: Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or…

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering...

Scanner Poses as 32 AI Bots to Find Credentials and Private Keys

A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to search websites for exposed credentials, private keys and cloud configuration files...

Measuring Users' Security and Privacy Concerns about Third-Party Community Bots on Discord

Third-party community-based bots are central to how social platforms such as Discord work. They moderate content, manage roles, play music, and support AI-assisted conversations across millions of servers. Yet when a bot is installed in a server, it can access messages, user profiles, and server...

CVE-2026-115725

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox sourceid. Attackers can call the conversations create endpoint with another account's sourceid to create or retrieve conversatio...

CVE-2026-115725 Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox sourceid. Attackers can call the conversations create endpoint with another account's sourceid to create or retrieve conversatio...

EUVD-2026-108713

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox sourceid. Attackers can call the conversations create endpoint with another account's sourceid to create or retrieve conversatio...

CVE-2026-115725 Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox sourceid. Attackers can call the conversations create endpoint with another account's sourceid to create or retrieve conversatio...

CVE-2026-115725

Chatwoot versions prior to 4.17.0 are vulnerable to a cross-account authorization bypass (CWE-639). This flaw allows authenticated agent bots to access unauthorized accounts by providing a foreign contact inbox source_id . Specifically, an attacker can call the conversations create endpoint using...

PT-2026-121837

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source id. Attackers can call the conversations create endpoint with another account's source id to create or retrieve...

Chatwoot authorization issue vulnerability

Versions of Chatwoot prior to 4.17.0 contain an authorization issue vulnerability. This vulnerability stems from authorization bypass; authenticated proxy bots can access other accounts by providing an external contact inbox sourceid, and then use that sourceid to invoke the conversations creatio...

Mervin Praison PraisonAI authorization issue vulnerability

Versions Mervin Praison PraisonAI from 3.11.0 up to 4.6.59 contain an authorization issue vulnerability. This vulnerability arises because Slack bots fail to apply the allowedusers, allowedchannels, and unknownuser pairing policies within their appmention event handler, allowing unauthorized user...

brawl-public-game-001

BRAWL Uno de los problemas desafiantes para los investigadores de ciberseguridad que desarrollan capacidades de detección y respuesta es encontrar un entorno realista para probar sus hipótesis y capacidades. El método más económico es probar capacidades en una pequeña red de laboratorio. Pero est...