natlas

Natlas Summary You've got a lot of maps and they are getting pretty unruly. What do you do? You put them in a book and call it an atlas. This is like that, except it's a website and it's a collection of nmaps. Natlas' objective is to make it easy to perform continuous scanning and review collecte...

natlas

Natlas Resumen Tienes muchos mapas y se están volviendo bastante difíciles de manejar. ¿Qué haces? Los pones en un libro y lo llamas atlas. Esto es similar, excepto que es un sitio web y es una colección de nmaps. El objetivo de Natlas es facilitar la realización de escaneos continuos y la revisi...

TraceTree

TraceTree TraceTree Demo TraceTree cascade-analyzer es un organismo de seguridad autónomo diseñado para la era de los agentes. Va más allá del simple escaneo para convertirse en un ecosistema de detección robusto, endurecido y escalable. Como su mascota, la araña, TraceTree teje una red integral ...

CVE-2026-107399 Mechanize sends credential headers to another origin after a meta refresh

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399

The Mechanize library (prior to version 2.14.1 ) fails to enforce an origin trust boundary within the Mechanize::HTTP::Agent#response_follow_meta_refresh function when follow_meta_refresh is enabled. This flaw allows a page containing a meta refresh to an external origin to cause the library to r...

EUVD-2026-95318

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

ExtAnalysis

Features • Installation • Use • Modules Used • Screenshots • License With ExtAnalysis you can : Download & Analyze Extensions From: Chrome Web Store Firefox Addons Analyze Installed Extensions of: Google Chrome Mozilla Firefox Opera Browser Coming Soon Upload and Scan Extensions. Supported format...

PentestingEverything

PentestingEverything A complete, searchable penetration-testing knowledge base across 23 security domains. Live website: pentesting.m14r41.in Live Website · PentestingChecklist · Contribute · Report an Issue Read it online at pentesting.m14r41.in : fully searchable, with 108 documentation pages,...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...

CVE-2026-107781

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...

CVE-2026-107782

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...

CVE-2026-107708

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...

CVE-2026-107778

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...

CVE-2026-107779

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...

CVE-2026-107780

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string an...

CVE-2026-107397

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

xsscrapy

xsscrapy Fast, thorough, XSS/SQLi spider. Give it a URL and it'll test every link it finds for cross-site scripting and some SQL injection vulnerabilities. See FAQ for more details about SQLi detection. From within the main folder run: ./xsscrapy.py -u http://example.com If you wish to login then...

CVE-2024-21626-runcPOC

Reproducción de la vulnerabilidad CVE-2024-21626 Vulnerabilidad de escape de docker runc 1. Introducción a la vulnerabilidad Nombre de la vulnerabilidad| Vulnerabilidad de escape de docker runc ---|--- ID de vulnerabilidad| CVE-2024-21626 Fecha de divulgación| 2024-01-31 Característica| /...

CVE-2022-41828

CVE-2022-41828 Controlador JDBC de Amazon AWS Redshift - Ejecución remota de código RCE El controlador JDBC de Amazon para Redshift es un controlador JDBC tipo 4 que proporciona conectividad a bases de datos a través de las interfaces de programación de aplicaciones API JDBC estándar disponibles ...