CVE-2026-55797

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...

TREVORspray

TREVORspray 2.0 TREVORspray est un pulvérisateur de mots de passe modulaire avec threading, proxy SSH, modules de butin, et plus encore ! Par @thetechr0mancer Installation : pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install...

honeybits

Honeybits Un outil PoC simple conçu pour améliorer l’efficacité de vos pièges en dispersant des miettes de pain et des honeytokens sur vos serveurs de production et postes de travail, afin d’attirer l’attaquant vers vos honeypots. Auteur : Adel « 0x4D31 » Karimi. La version Windows de ce projet :...

CVE-2018-9995-ModifiedByGwolfs

состояние Этот инструмент является улучшенной версией CVE-2018-9995, написанной gwolfs, и предназначен только для обучения. Не используйте в незаконных целях — все последствия ложатся на вас. Оригинальная версия написана ezelf и находится по адресу...

MalSeclogon

MalSeclogon Небольшой инструмент для работы со службой Seclogon. Полные технические подробности: https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html Использование MalSeclogon v0.2 @splintercode Arg...

postEX

PostEX - Agent de Reconnaissance Post-Exploitation Pour les tests de sécurité autorisés uniquement. Toute utilisation non autorisée est illégale. PostEX est un agent de reconnaissance post-exploitation basé sur Python pour Windows. Il collecte les informations système, le statut des privilèges, l...

CVE-2020-1472

CVE-2020-1472 POC Требуется последняя версия impacket из GitHub с добавленными структурами netlogon. Обратите внимание, что по умолчанию это изменяет пароль учётной записи контроллера домена. Да, это позволяет выполнить DCSync, но также нарушает связь с другими контроллерами домена, так что будьт...

ultrafuzz

Ultrafuzz Ultrafuzz is an agentic orchestrator for smart contract fuzzing and threat hunting This tool initializes a protocol repository with editable prompts and topology, runs specialized agents, collects generated fuzz tests and findings, and serves a local dashboard plus final report for...

CVE-2026-103259

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103259

The n8n application versions before 2.39.6 and 2.40.x before 2.40.1 are vulnerable to a session token leakage in the Dynamic Credentials authorize and revoke endpoints. Attackers who possess resolver registration capability can capture collaborators' session tokens by configuring a fallback resol...

CVE-2026-103259: Incorrect Authorization

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-95654

Databasement before 1.7.14 is affected by an authorization bypass via stale invitation tokens . The vulnerability resides in the invitation acceptance flow (AcceptInvitation.php), where the system validates the token only when the page loads and caches the authorization decision without re-checki...

CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...

EUVD-2026-83952

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...

Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has...

CVE-2026-92133

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

EUVD-2026-80757

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

CVE-2026-92133

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

EUVD-2026-80754

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...