CVE-2025-4664

🔒 Vulnerabilidad CVE-2025-4664 La vulnerabilidad CVE-2025-4664 es un fallo de seguridad de alta gravedad identificado en el componente Loader de Google Chrome, presente en versiones anteriores a la 136.0.7103.113. Este problema permite a un atacante remoto filtrar datos de origen cruzado mediante...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable . Befor...

CVE-2015-5119

CVE-2015-5119 Un exploit tipo COOP...

theftfuzzer

┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘└─┘┴└─ Introducción: TheftFuzzer es una herramienta que fuzzea implementaciones de Intercambio de Recursos de Origen Cruzado en busca de configuraciones incorrectas comunes. Uso: python theftfuzzer.py -d...

CVE-2023-45857-Demo

Demostración para verificar el comportamiento de la vulnerabilidad CVE-2023-45857 de axios 1. Iniciar con dev container 2. Ejecutar npm run dev en el contenedor app 3. Acceder a http://app.localhost 4. Verificar que la Cookie XSRF-TOKEN esté configurada en las herramientas de desarrollador del...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

cve-2020-16012

Este repositorio contiene PoCs para CVE-2020-16012, una vulnerabilidad de canal lateral en la implementación de CanvasRenderingContext2D.drawImage en Firefox y Chromium. Lee un informe de esta vulnerabilidad en el blog de Mozilla Attack & Defense. Dentro de benchmark hay código para medir el tiem...

dns-rebind-toolkit

DNS Rebind Toolkit 데모 | 보안 권고 | 포함된 페이로드 | FAQ 면책 조항: 이 소프트웨어는 교육 목적으로만 제공됩니다. 이 소프트웨어는 불법 활동에 사용되어서는 안 됩니다. 저자는 그 사용에 대해 책임을 지지 않습니다. 나쁜 짓 하지 마세요. DNS Rebind Toolkit은 로컬 영역 네트워크LAN의 취약한 호스트와 서비스를 대상으로 하는 DNS 리바인딩 익스플로잇을 개발하기 위한 프론트엔드 자바스크립트 프레임워크입니다. Google Home, Roku, Sonos WiFi 스피커, WiFi 라우터,...

CVE-2026-43735

CVE-2026-43735 Fuga de información entre orígenes en WebKit. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Cómo funciona Cuando la página padre usa para provocar una navegación por fragmento del iframe entre orígenes, el NavigateEvent.sourceElement que recibe el iframe es ese...

EUVD-2026-73930

n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content...

CVE-2026-88061 career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

CVE-2026-88061

career-ops (an open-source AI-assisted job search tool) prior to 0.8.0 exposed its local web dashboard (web/) /api routes for command-spawning and user-file-writing without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could issue ...

CVE-2026-88887

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

CVE-2026-88882

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

CVE-2026-88887 Renovate before 44.11.2 Credential Exfiltration via Link Header

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

CVE-2026-88882

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images before 15.4.0, helm chart before 10.4.0), when fetching package versions from a NuGet registry , Renovate follows pagination URLs returned in the HTTP Link header without verifying the targ...

USN-8740-1 dotnet8, dotnet10 vulnerabilities

Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. CVE-2026-58649 Rajesh Chada discovered that the .NET watch AspireServerService improperl...

USN-8740-1: .NET vulnerabilities

Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. CVE-2026-58649 Rajesh Chada discovered that the .NET watch AspireServerService improperl...