CVE-2026-108631

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE request...

CVE-2026-108634

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit the...

CVE-2026-108615

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

CVE-2026-108611

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove a...

CVE-2026-108608

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET...

CVE-2026-108607

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked G...

CVE-2026-108609

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech...

CnaEmulator

CnaEmulator - Cobalt Strike Aggressor Script Emulator & Mock Harness CnaEmulator ist ein eigenständiges, universell einsetzbares Entwicklungs-, Emulations- und Test-Harness für Cobalt Strike Aggressor Scripts .cna. Es ermöglicht Sicherheitsforschern, Tool-Entwicklern und BOF-Autoren, die...

CVE-2022-26937

Crash PoC del File System di Rete Windows CVE-2022-26937 nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data structure. Th...

hakrevdns

hakrevdns Kleines, schnelles und einfaches Tool für die Durchführung von Reverse-DNS-Lookups in großem Umfang. Du fütterst es mit IP-Adressen, es gibt Hostnamen zurück. Dies kann eine nützliche Methode sein, um Domains und Subdomains eines Unternehmens anhand ihrer IP-Adressen zu finden...

pumba

Chaos-Testwerkzeug für Docker, containerd und Podman Schnellstart · Benutzerhandbuch · Netzwerk-Chaos · Bereitstellung · Mitwirken Pumba ist ein Chaos-Test- und Netzwerk-Emulationswerkzeug für Docker-, containerd- und Podman-Container. Inspiriert von Netflix Chaos Monkey bringt Pumba Chaos...

RMS-Runtime-Mobile-Security

Runtime Mobile Security RMS 📱🔥 by @mobilesecurity Runtime Mobile Security RMS , basato su FRIDA, è una potente interfaccia web che ti aiuta a manipolare app Android e iOS in fase di esecuzione. Con RMS puoi facilmente dumpare tutte le classi caricate e i relativi metodi, agganciare qualsiasi cosa...

cloudfox

🦊 CloudFox 🦊 CloudFox ti aiuta a ottenere consapevolezza situazionale in ambienti cloud sconosciuti. È uno strumento a riga di comando open source creato per aiutare penetration tester e altri professionisti della sicurezza offensiva a trovare percorsi di attacco sfruttabili nell'infrastruttura...

semgrep-rules

semgrep-rules Willkommen! Dieses Repository enthält die Community-Edition-Regeln von Semgrep. Zusätzlich zu den Regeln in diesem Repository bietet das Semgrep Registry proprietäre Pro-Regeln, die eine zusätzliche Sprachabdeckung bieten und Crossfile- sowie tiefgehende Datenflussanalysen...

awesome-security

Awesome Security Una raccolta di fantastico software, librerie, documenti, libri, risorse e contenuti interessanti sulla sicurezza. Ispirato da awesome-php, awesome-python. Grazie a tutti i contributori, siete fantastici e senza di voi non sarebbe possibile! L'obiettivo è costruire una raccolta...

ctf-tools

ctf-tools Questa è una raccolta di script di configurazione per creare un'installazione di vari strumenti di ricerca sulla sicurezza. Certo, non è un problema difficile, ma è molto comodo averli tutti in un unico posto facilmente distribuibile su nuove macchine e così via. Gli script di...

-LogicSentry-AI

LogicSentry AI LogicSentry AI ist eine deterministische, offline arbeitende Anwendungs-Sicherheits-Triage-Engine, die darauf ausgelegt ist, vollständig innerhalb Ihrer lokalen Laufzeitumgebung zu laufen. Sie kombiniert statische Anwendungssicherheitstests SAST und dynamische...

CVE-2026-108674 JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain interna...

CVE-2026-108674

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the OpenApiController queryById handler. This flaw allows low-privileged authenticated users to access OpenAPI definitions without the required permissions. By sending a GET request to /openapi/queryById wit...

CVE-2026-108674

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain interna...