1341232 matches found
CVE-2026-114272 Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure
Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent reques...
CVE-2026-102704
A flaw was found in Xen. An unprivileged guest domain can bypass memory isolation controls during batched grant copy operations, which are used to share memory between virtual machines. Due to a misplaced validation check when reusing cached memory verification details, Xen permits memory copying...
EUVD-2026-117411
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers su...
EUVD-2026-117409
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie,...
EUVD-2026-117410
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when...
EUVD-2026-117403
A flaw was found in ansible-core. When a task marked nolog: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/internal/task.py, and the default stdout callback prints it through...
GoogleIndexRetriever
Google index Retriever Have you ever found a webpage that seems to talk exactly about what you need, but it has been removed? Yes, Google cache is the answer but... What if the cache has been removed too? What if the site is just in Google Index page? You can not get the webpage back, but you kno...
CVE-2026-123047
Eclipse BaSyx Helm Charts (versions 3.0.0-rc.1 to 3.12.1 ) of the basyx chart contain a vulnerability where bundled Keycloak user passwords, including the bootstrap administrator, are stored in cleartext within a Kubernetes ConfigMap (-basyx-keycloak-init-config). The root cause is the keycloak-i...
owasp-threat-dragon-desktop
OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...
CVE-2026-73101
The Apache Juneau REST server is vulnerable to Generation of Error Message Containing Sensitive Information (CWE-209) in versions through 9.2.0 . The server discloses internal exception classes and messages to remote clients via a "Thrown" response header on every error response. Additionally, in...
CVE-2026-73100
The Apache Juneau REST server call logger (versions through 9.2.0 ) is vulnerable to an Insertion of Sensitive Information into Log File vulnerability. The logger records request headers for requests resulting in server errors without redacting sensitive data. This allows headers including Author...
CVE-2014-0160
π CVE-2014-0160 β "Heartbleed" π Table of Contents Overview Technical Background Root Cause Impact Affected Versions Exploitation Overview Mitigation & Patch Timeline Lessons Learned Summary π Overview Heartbleed is the nickname for CVE-2014-0160 , a severe vulnerability in OpenSSLβs TLS heartbea...
r3con
R3CON Multifunctional Web Recon & Vulnerability Scanner Tool r3con is a Multifunctional Web Recon & Vulnerability Scanner Tool and incredibly fast crawler that can find multiple vulnerabilitys and gather information. Check for vulnerabilities Reflected XSS Multi-threaded crawling Open-redirection...
wphunter
WPHunter Tool β£ WPHunter A Wordpress Vulnerability Scanner You can use this tool on your wordpress website to check the security of your website by finding the vulnerability in your website. Over 75 million websites run on WordPress. which is now powers 26% of the Web. Remarkably enough thousands...
pcc
PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...
RepoReaper
RepoReaper Overview RepoReaper is a precision tool designed to automate the identification of exposed .git repositories across a list of domains and subdomains. By processing a user-provided text file with domain names, RepoReaper systematically checks each for publicly accessible .git files. Thi...
shortscan
π Shortscan An IIS short filename enumeration tool. Functionality Shortscan is designed to quickly determine which files with short filenames exist on an IIS webserver. Once a short filename has been identified the tool will try to automatically identify the full filename. In addition to standard...
SwaggerSpy
SwaggerSpy Overview SwaggerSpy is a tool designed for automated Open Source Intelligence OSINT on SwaggerHub. This project aims to streamline the process of gathering intelligence from APIs documented on SwaggerHub, providing valuable insights for security researchers, developers, and IT...
policymaker
policymaker Generate a real vulnerability-disclosure policy β VDP, safe harbor, security.txt & DNS Security TXT β in minutes. No lawyer required. Part ofthe disclose.io Project β the open, vendor-neutral infrastructure for vulnerability disclosure. Browse the ecosystem β policymaker.disclose.io i...
mongobleed
mongobleed CVE-2025-14847 - MongoDB Unauthenticated Memory Leak Exploit A proof-of-concept exploit for the MongoDB zlib decompression vulnerability that allows unauthenticated attackers to leak sensitive server memory. Vulnerability A flaw in MongoDB's zlib message decompression returns the...