BIT-GHOST-2026-104415 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

BIT-GHOST-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

GetFGPP

GetFGPP Dumps Fine Grained Password Policies FGPP from Active Directory via LDAP. Requires read access to the Password Settings Container — by default only admins have this right, but it's occasionally misconfigured. Install pip3 install ldap3 python-dateutil no longer required Usage usage: fgpp....

RITM

RITM This is a Python implementation of the man-in-the-middle attack described by Charlie Clark @exploitph in his post, New Attack Paths? AS Requested Service Tickets, and demonstrated in his proof-of-concept, Roast in the Middle. In short, this tool: 1. Performs ARP spoofing between your targets...

CVE-2026-97468

Apache CXF 's STSTokenValidator and Security Token Service (STS) are vulnerable to an authentication bypass because they cache validated security tokens using a weak, non-cryptographic 32-bit hash (Java Arrays.hashCode/hashCode() ). A remote attacker can craft a security token, such as a Username...

CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

CVE-2026-97468

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

EUVD-2026-95699

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

K000163622: Python vulnerability CVE-2026-7210

Security Advisory Description xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and...

lnkbomb

Lnkbomb Lnkbomb se utiliza para subir archivos de acceso directo maliciosos a recursos compartidos inseguros. La vulnerabilidad existe debido a que Windows busca un archivo de icono para asociar con el archivo de acceso directo. Este archivo de icono puede dirigirse a la máquina del probador de...

hassh

"HASSH" - un Método de Perfilado para Clientes y Servidores SSH. "HASSH" es un estándar de huellas digitales de red que se puede utilizar para identificar implementaciones específicas de Cliente y Servidor SSH. Las huellas digitales se pueden almacenar, buscar y compartir fácilmente en forma de u...

ioccheck

ioccheck Una herramienta para simplificar el proceso de investigar hashes de archivos, direcciones IP y otros indicadores de compromiso IOCs. Características Consulta hashes en múltiples servicios de inteligencia de amenazas, desde un solo comando o unas pocas líneas de Python. Actualmente soport...

CLEANSTART-2026-QV20553 SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2

Security vulnerability affects the apache2 package. SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2...

PT-2026-108866

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The STSTokenValidator and Security Token Service STS cache validated security tokens using a non-cryptographic 32-bit hash...

hashes

Hash magici – "collisioni" di hash PHP Registrati con password 1 e poi accedi con password 2. Se riesci ad accedere, l'archiviazione usa l'algoritmo specificato per calcolare l'hash della password e PHP usa == per confrontarle per MD5, SHA-1 e plaintext. MD5, SHA-1, SHA-224, SHA-256 e altri Per M...

kernel: ipvlan: Make the addrs_lock be per port

A race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrslock was incorrectly used instead of a per-port lock, and some code paths ipvlanopen/ipvlanclose failed to acquire the lock entirely. For IPv6 address changes that don't require RTNL lock, concurrent...

hassh

"HASSH" - un metodo di profilazione per client e server SSH. NOTA: questo repository Corelight è stato creato affinché possa essere mantenuto attivamente, su richiesta di Salesforce, il cui repository originale non viene più mantenuto. "HASSH" è uno standard di fingerprinting di rete che può esse...

kernel: ipvlan: Make the addrs_lock be per port

A race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrslock was incorrectly used instead of a per-port lock, and some code paths ipvlanopen/ipvlanclose failed to acquire the lock entirely. For IPv6 address changes that don't require RTNL lock, concurrent...

CVE-2026-105193

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...

CVE-2026-105193 Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...