CVE-2026-93290

The Eufy Omni C20 is affected by a vulnerability involving the use of hard-coded credentials . An attacker who is able to monitor the device's log files could obtain these credentials to gain unauthorized access to sensitive information, such as mapping data . No specific remediation or patch ver...

CVE-2026-93290 Use of Hard-coded Credentials in Eufy Omni C20

Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data...

CVE-2026-82371

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed...

CVE-2026-82371

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed...

EUVD-2026-86349

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed...

CVE-2026-82371 Plaintext exposure of sensitive authentication data in SANnav discovery service log files

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed...

CVE-2026-77293

The collaborative travel planner TREK is vulnerable to an Insecure Direct Object Reference (IDOR) or Broken Access Control issue in versions prior to 3.3.0 . The DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint fails to properly verify if the target note-file belongs to the a...

CVE-2026-77293 TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

CVE-2026-23907

Vulnerabilidad de Path Traversal en Apache PDFBox Resumen de la Vulnerabilidad Descripción El código de ejemplo ExtractEmbeddedFiles de Apache PDFBox no sanitiza los nombres de archivo al extraer archivos incrustados de PDFs. Un atacante puede incrustar archivos con secuencias de path traversal ....

CVE-2026-63498

The Snipe-IT IT asset management system is vulnerable to Stored XSS in versions prior to 8.7.0 . The vulnerability exists in the uploaded-files API endpoint (GET /api/v1/{object_type}/{id}/files/{file_id}) because the app/Http/Controllers/Api/UploadedFilesController.php show path fails to apply t...

CVE-2026-97226

A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...

Manalyze

Manalyze 简介 Manalyze 是一款针对 PE 文件的静态分析工具，可用于对可执行文件（或一组可执行文件）进行初步评估。它收集可能指示恶意行为的微弱信号，并显示有助于后续手动分析的信息。 如果您想查看该工具生成的示例报告，请随意试用我为其创建的网络服务：manalyzer.org。 目录 PE文件的静态分析器 如何构建 生成ClamAV规则 使用 使用Manalyze的用户 联系方式 PE文件的静态分析器 Manalyze 使用 C++ 编写，支持 Windows 和 Linux，并根据 GPLv3 许可证 发布。它是一款健壮的 PE...

cpanel-cve-2026-41940-ioc

CVE-2026-41940 IOC Scanner Detection script for the cPanel/WHM authentication bypass CVE-2026-41940 affecting all cPanel versions after 11.40. This is a rewrite of the upstream cPanel detection script with fixes for false positives and added log correlation. What it does Scans...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion es una plataforma de desarrollo rápido para crear e implementar aplicaciones web y móviles. CVE-2024-20767 - Las versiones de ColdFusion 2023.6, 2021.12 y anteriores están afectadas por una vulnerabilidad de Control de Acceso Inadecuado que podría...

dangerzone

Dangerzone 获取可能危险的PDF、办公文档或图像，并将其转换为安全的PDF。 | ---|--- Dangerzone的工作原理如下：您提供一个不确定是否可信任的文档（例如邮件附件）。在沙箱内部，Dangerzone将该文档转换为PDF（如果还不是PDF格式），然后将PDF转换为原始像素数据：每页一个巨大的RGB颜色值列表。然后，在沙箱外部，Dangerzone获取这些像素数据并将其转换回PDF。 在官方网站了解更多关于Dangerzone的信息。 快速开始 请按照各平台的说明进行操作： macOS Windows Ubuntu Linux Debian Linux Fedor...

jadx

JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...

fuzzuli

fuzzuli 动机 • 背景 • 安装 • 用法 • 运行 fuzzuli • 工具页面 fuzzuli 是一个 URL 模糊测试工具，旨在通过基于域名创建动态字典来发现关键备份文件。 动机 在我多年来进行应用安全测试的过程中，我发现大量关键备份文件被保存在外部可访问的目录中。在命名这些文件时，通常使用了一些常见词汇（如 backup.zip、db.rar、conf.tar.gz 等）。然而，大多数文件是根据应用程序所在的域名来命名的。假设我们有一个域名地址 fuzzuli.musana.net，如果开发者将关键备份文件保存在可访问目录中，可能的文件名会是这样。raw...

LazySign

LazySign 使用 Windows 二进制文件和 bat 文件为二进制文件创建假证书 多年来，已经发布了几种能够窃取或伪造二进制文件签名的酷工具。 然而，所有这些工具都需要额外的依赖项，如 Go、Python 等。 本仓库让你无需任何额外依赖即可进行假签名，所有使用的二进制文件均来自微软自己的开发工具包。 我编写了一个 bat 文件来简化操作。 Invoke-LazySign.ps1 PowerShell 脚本是另一个选项，它既不需要额外的依赖，也不需要额外的二进制文件，只需干净利落的 PowerShell cmdlet。 所以，如果你和我一样懒，只需克隆此仓库，运行 bat 或...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Sample EVTX files are in the .\evtx directory Note If your antivirus freaks out after...