thedorkbox

thedorkbox TheDorkbox Comprehensive collection of Google Dorks & OSINT techniques to find Confidential Data Welcome to thedorkbox 👋 This is an OSINT tool which consists of various Google dorks embedded into HTML template so that non-technical users get the importance of OSINT techniques and how...

bucket-stream

🚨 Bucket Stream is no longer maintained. If you need support or consultation for your red teaming endeavours, drop me an e-mail [email protected] 🚨 Bucket Stream Find interesting Amazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate...

CVE-2026-55598 PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

CVE-2026-55598 PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

EUVD-2026-114370

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

CVE-2026-55598 PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

CVE-2026-55598

The PinePods podcast management system (prior to version 0.9.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . An authenticated user can subscribe to a malicious RSS feed via POST /api/data/add_podcast, causing the system to parse and store values without host or IP validation. When down...

CVE-2026-55598: madeofpendletonwool PinePods: PinePods is a complete, self-hosted podcast management system written in Rust

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

ROS-20261026-73-0104

The vulnerability of the SSH network protocol is related to an error in password hashing. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data remotely...

ROS-20261022-73-0075

The vulnerability of the extension unit search mechanism for the UVC H.264 RDP client FreeRDP, related to memory reading beyond the allocated range, allows a perpetrator to access potentially confidential data...

ROS-20261019-73-0016

The vulnerability of the Vim text editor is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions...

ROS-20261019-73-0018

The vulnerability of the regexpnfa.c component in the text editor Vim is related to the use of memory after it is freed. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

CVE-2026-109812 Missing Authorization on Secret Endpoints

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

EUVD-2026-102593

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

CVE-2026-109812 Missing Authorization on Secret Endpoints

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

PT-2026-115397

Name of the Vulnerable Software and Affected Versions Moxa industrial computing products affected versions not specified Description A missing authorization issue exists in the internal API endpoint /api/v1/secrets/. A low-privileged authenticated attacker with adjacent network access can exploit...

CVE-2026-109812: Missing Authorization

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

Moxa AIG-302 Series Authorization Issue Vulnerability

The Moxa AIG-302 Series from version 1.0.0 to 1.4.0 has an authorization vulnerability. This vulnerability stems from the lack of authorization verification in the internal API /api/v1/secrets/. Attackers with low privileges can access sensitive information through adjacent networks, resulting in...

ROS-20261012-73-0234

The vulnerability of the mctp-i2c.c component in the Linux operating system’s kernel is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to access confidential data...

Aiohttp HTTP Client Source Verification Confidential Data Access

The vulnerability of the Aiohttp HTTP client is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...