EUVD-2026-95985

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtrcloudtoken and @mindwtrwebdavpassword. A party with access to the application...

CVE-2026-107857

The Mindwtr mobile application (versions prior to 1.1.5 ) suffers from a vulnerability where the Cloud sync bearer token and WebDAV password are stored in plaintext within unencrypted AsyncStorage . Specifically, these credentials are stored under the keys @mindwtr_cloud_token and @mindwtr_webdav...

CVE-2026-107857 Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtrcloudtoken and @mindwtrwebdavpassword. A party with access to the application...

pe-sieve

소개 PE-sieve 는 시스템에서 실행 중인 악성코드를 탐지하고, 추가 분석을 위해 잠재적으로 악의적인 자료를 수집하는 데 도움이 되는 도구입니다. 스캔된 프로세스 내에서 다양한 임플란트대체/주입된 PE, 셸코드, 후크 및 기타 메모리 패치를 인식하고 덤프합니다. 인라인 후크, 프로세스 할로잉, 프로세스 도펠갱잉, 리플렉티브 DLL 인젝션 등을 탐지합니다. PE-sieve는 한 번에 단일 프로세스 를 스캔하는 데 전념하는 경량 엔진 입니다. EXE 또는 DLL로 빌드할 수 있습니다. DLL 버전은 간단한 API를 제공하며 다...

EUVD-2026-95984

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...

CVE-2026-107856

CiviForm versions prior to 3.33.0 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to properly validate ownership when processing requests to GET /admin/tiDash/editClientForm/:accountId. While the system confirms the requester is a Trusted Intermediary , th...

CVE-2026-107856 CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...

no-gdid

no-gdid Read, understand, and silence the Windows Global Device Identifier GDID — the hidden per-account device ID that helped the FBI locate a suspect who was using a VPN. ⚠️ Honest disclaimer up front: this tool does not erase your GDID and does not make you anonymous. The GDID lives on...

EUVD-2026-95983

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

CVE-2026-107854

The Jexactyl game management and billing system (versions 4.0.0 to 4.0.5 ) contains an authorization bypass vulnerability in the POST /api/client/billing/free/process endpoint. The application fails to verify ownership when processing a client-controlled server_id , allowing an authenticated user...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

ida_ifl

IFL - 대화형 함수 목록 라이선스: CC-BY https://creativecommons.org/licenses/by/3.0/ 함수와 해당 참조 간을 사용자 친화적인 방식으로 탐색할 수 있도록 제공하는 것을 목표로 하는 작은 플러그인입니다. 또한, PE-sieve 등으로 생성된 보고서를 IDA로 가져올 수 있습니다. 지원 항목: .tag 형식 PE-sieve, Tiny Tracer, PE-bear에서 생성 .imports.txt 형식 PE-sieve에서 생성 Python 2용 레거시 버전은python2 브랜치에서 사용할 수...

screenscrub

screenscrub Find credentials in screenshots, extract them to a secret manager, and irreversibly redact them from the images — so secrets don't rot in your notes, screenshots, and /Desktop. Local. Offline. Silent. No network, no telemetry by default. screenscrub bridges two existing tool categorie...

CVE-2026-107852

In Jexactyl (a game management and billing system), a vulnerability exists prior to version 4.0.5 in the POST /api/client/billing/stripe/process endpoint. The system fails to verify if the amount_total or currency of a client-supplied Stripe Checkout Session matches the referenced order's require...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

EUVD-2026-95982

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

EUVD-2026-95981

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...

CVE-2026-107851

The Contao Open Source CMS (versions 5.7.0 through 5.7.12) contains an improper access control vulnerability in the TableAccessVoter::hasAccessToModule() function located in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php. The root cause is that the voter caches authorization de...

CVE-2026-107851 Contao: Improper access control in the table access voter

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...

reconspider

Most Advanced Open Source Intelligence OSINT Framework ReconSpider ReconSpider is most Advanced Open Source Intelligence OSINT Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers,...