EUVD-2026-96919

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys...

CVE-2026-108745 CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

CVE-2026-108745 CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

EUVD-2026-96910

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

CVE-2026-108720 phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...

CVE-2026-108715 LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

CVE-2026-108715

LibreNMS versions through 26.9.1.1 are affected by an authorization bypass vulnerability in the includes/html/graphs/smokeping/auth.inc.php component. The root cause is an incorrect authorization check that validates the src probe device instead of the rendered target device . Consequently, restr...

CVE-2026-108715 LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108712

SuiteCRM versions through 7.15.2 and 8.10.2 are affected by a missing authorization vulnerability in the DetailUserRole entry point. This flaw allows authenticated non-admin users to view the ACL data of other non-admin users. An attacker can achieve this by supplying another user's ID in the rec...

CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

EUVD-2026-96986

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108711

Plastic Labs Honcho versions through 3.3.0 are vulnerable to an incorrect authorization flaw (CWE-863) via the POST /v3/workspaces endpoint. The root cause is that the get_or_create_workspace function only validates the workspace claim, allowing API key holders with peer- or session-scoped access...

EUVD-2026-96985

Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...

lk_scraper

LinkedIn Scraper Extrae cualquier dato de LinkedIn Instalación $ pip install git+git://github.com/jqueguiner/lkscraper Configuración Usando Docker compose $ docker-compose up -d $ docker-compose run lkscraper python3 Usando Docker solo para el servidor de Selenium Primero, necesita ejecutar un...

pytm

pytm: Un marco Pythonico para modelado de amenazas Introducción El modelado de amenazas tradicional a menudo llega tarde a la fiesta, o a veces no llega en absoluto. Además, crear flujos de datos e informes manuales puede ser extremadamente lento. El objetivo de pytm es desplazar el modelado de...

mhf

Mobile Helper Framework es una herramienta que automatiza el proceso de identificar el framework/tecnología utilizado para crear una aplicación móvil. Además, ayuda a encontrar información sensible o brinda sugerencias para trabajar con la plataforma identificada. ¿Cómo funciona? La herramienta...

http-protocol-exfil

http-protocol-exfil Usa la versión del protocolo HTTP para enviar un archivo bit a bit "HTTP/1.0" es un 0 y "HTTP/1.1" es un 1. Utiliza peticiones GET, por lo que el Blue Team solo vería las solicitudes a tu dirección IP. Sin embargo, se necesita mucho tiempo para enviar archivos grandes; por...

baserunner

Baserunner Una herramienta para explorar y explotar almacenes de datos de Firebase. Consulte esta publicación en nuestro blog para obtener una visión general de cómo funciona Firebase y por qué desarrollamos esta herramienta. Configuración 1. git clone https://github.com/iosiro/baserunner.git 2. ...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versiones anteriores a 1.13 hasta 1.13.10, 2.0 hasta 2.0.5, y versiones antiguas no soportadas, contienen una vulnerabilidad de enlace de propiedades causada por una neutralización incorrecta de elementos especiales. Un usuario malicioso remoto no autenticado o...