react2shell-scanner

Сканер уязвимости React2Shell Безопасный, неинвазивный сканер для обнаружения уязвимостей React Server Components RSC и удаленного выполнения кода в Next.js CVE-2025-55182 и CVE-2025-66478. Обзор Этот сканер помогает организациям определить, уязвимы ли их веб-сервисы для уязвимости React2Shell,...

RedLine-Stealer-C2-Defender-Bypass-Payload-Analysis

1. C2-подключение – IP 198.46.86.63 Сетевой анализ показывает, что RedLine Stealer устанавливает соединение с удалённым IP-адресом 198.46.86.63. Этот IP, вероятно, является сервером управления C2 вредоносной программы, используемым для кражи данных и доставки команд. Ключевые наблюдения: IP-адрес...

CVE-2024-58290-Xhibiter-SQLi

CVE-2024-58290-Xhibiter-SQLi Доказательство концепции PoC для SQL-инъекции в Xhibiter NFT Marketplace 1.10.2 конечная точка Collections. Обнаружено Sohel Yousef. CVE-2024-58290: Xhibiter NFT Marketplace SQL-инъекция Название эксплойта: Xhibiter NFT Marketplace 1.10.2 - SQL-инъекция без...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

CVE-2026-12260

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to access data sources they are not authorized to view. The /unauth-datasource and /authed-datasource endpoints fail to enforce proper access controls, potentially leaking sensitive conne...

EUVD-2026-94808

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

CVE-2026-71183 Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

Exploit for CVE-2026-21589

CVE-2026-21589 — Atlassian pre-auth arbitrary file read Pytho...

kernel: ipv6: fix use-after-free in ip6_finish_output2()

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6finishoutput2 function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

CVE-2026-12260

The NetBoard CRM demo platform is vulnerable to a SQL injection flaw in the ‘user-name’ POST parameter of the ‘/module/auth/recovery.php’ endpoint. The vulnerability allows for blind attacks using Boolean, error, time-based, and UNION techniques. Successful exploitation enables an attacker to ext...

EUVD-2026-94803

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data

The U.S. Department of Justice DoJ on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. Zohar Pinhasi aka Zack...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

casper-shell

🦇 Casper@shell: - Продвинутая PHP веб-оболочка Casper@shell: — это улучшенная, более удобная версия оболочки p0wny с множеством новых функций. Эта версия создана для быстрого выполнения разведки, эксфильтрации или развертывания механизмов постоянства. ✨ Возможности 🖥️ Расширенный терминал Полная...

Malicious code in css-flow-render-shim (npm)

Source: amazon-inspector f008c8756b09bb1840b05eafe5a30432475f6cc2d5a10064a42920059e8784fd The package publishes an empty index.js stub but ships Thunderbolt manifests that register payload.bundle.min.js as the bundle for core Wix components across the thunderbolt/wixui and thunderbolt/dsgnsys...

CVE-2026-85486

Brocade ASCG versions prior to 3.5.0 are vulnerable to Remote Code Execution (RCE) due to improper input processing. The software evaluates form data before performing necessary validation. An authenticated user with basic access can submit a configuration form containing crafted input , which th...

CVE-2026-85486

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code...