nanorobeus

Nanorobeus COFF file BOF for managing Kerberos tickets. Supported agents Sliver Brute Ratel Cobalt Strike Commands luid - get current logon ID sessions /luid: | /all - get logon sessions klist /luid: | /all - list Kerberos tickets dump /luid: | /all - dump Kerberos tickets ptt /ticket: /luid:...

CVE-2026-111056

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...

CVE-2026-111056

The FOSSBilling open-source billing platform is vulnerable to unauthenticated client account enumeration in versions 0.1.0 through 0.8.7 . The issue exists in the POST /api/guest/client/create endpoint, where the Box Mod Client Api Guest::create method returns an unredacted error message when Cli...

EUVD-2026-104418

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...

CVE-2026-111056 FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...

CVE-2026-110239

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...

CVE-2026-110239 Rapyd Admin before 9.20.0 Stored XSS via rich-text Component

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...

CVE-2026-110239

The Rapyd Admin software versions prior to 9.20.0 is vulnerable to a stored cross-site scripting (XSS) flaw within the x-rpd::rich-text Blade component. The root cause is the component's failure to sanitize bound model values, which are instead output as raw HTML. An authenticated user can exploi...

CVE-2026-110239 Rapyd Admin before 9.20.0 Stored XSS via rich-text Component

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...

CVE-2026-110239: Improper Neutralization of Input During Web Page Generation

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...

IMAP Client API Ruby Command Injection

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

IMAP Client API Ruby Command Injection

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

IMAP Client API Ruby DoS

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to incorrect filtering of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

io.github.bkoehm:apacheds-embedded (0.6), org.apache.camel.karaf:camel-ldif (>=4.14.5, <=4.18.4) +56 more potentially affected by CVE-2026-103878 via org.apache.directory.api:api-ldap-client-api (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-ldap-client-api MAVEN version =2.1.0, =4.14.5, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =2.1.0, =2.1.0, =2.1.0, =2.1.8 - org.apache.directory.server:apacheds-core 2.0.0.am27 - org.apache.directory.server:apacheds-core-annotations 2.0.0.am27 -...

Ruby IMAP Library CRLF Injection

The vulnerability in the client API library for the IMAP protocol in Ruby is related to the failure to implement measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary IMAP commands remotely...

CVE-2026-27708

FOSSBilling, before 0.8.0, is vulnerable to an IDOR in the Servicecustom Client API: the __call method accepts an order_id and fetches the order without ensuring the authenticated client owns it, enabling cross-client access to other clients’ orders and exposing PII and service configuration data...

CVE-2026-27708: Improper Access Control

FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's call method accepts an orderid parameter and fetches the associated order without verifying the authenticated client owns it, potentially exposing cross-client data...

CVE-2026-35202 Pterodactyl has a database resource limit bypass via race condition in Client API

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broke...

CVE-2026-35202 Pterodactyl has a database resource limit bypass via race condition in Client API

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broke...

CVE-2026-35202: Time-of-check Time-of-use (TOCTOU) Race Condition

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broke...