ntopng

ntopng Introduction ntopng® is a web-based network traffic monitoring application released under GPLv3. It is the new incarnation of the original ntop written in 1998, and now revamped in terms of performance, usability, and features. While you can read more about ntopng on the ntop web site...

Bootstrap-with-XSS

Raccolta di PoC per vulnerabilità storiche di Bootstrap Questa è una pagina HTML statica per scopi di studio e ricerca, che integra molteplici proof of concept PoC di vulnerabilità cross-site scripting XSS nella storia del framework Bootstrap. Questo progetto ha lo scopo di fornire a ricercatori ...

Weblogic_Vuln

Prefazione root@kitploit: L'articolo analizza in dettaglio le vulnerabilità storiche di Weblogic da CVE-2015 a CVE-2019 e raccoglie i relativi POC in WeblogicVuln. Registra gli appunti di studio sulle vulnerabilità di deserializzazione Java. Benvenuti a lasciare una star e aprire issue...

CVE-2026-78195

A Cross-Site Scripting XSS vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's browser...

CVE-2026-78195

...

CVE-2026-78195

A stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension 's Backup Historical Data feature allows an authenticated administrator to execute arbitrary JavaScript in another user's browser. The flaw is classified as Stored XSS (per the CVE record title) and is scored CVSS 4.0: 5.1 ...

CVE-2026-73265

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known...

CVE-2026-73265

Vulnerability (CVE-2026-73265) : In RustFS, the GetObject/CopyObject/UploadPartCopy paths incorrectly authorize reads of historical versions using s3:GetObject instead of s3:GetObjectVersion, enabling principals without historical-version permissions to disclose known historical content. This aff...

PT-2026-71086

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known...

CVE-2026-72586

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-72586

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

EUVD-2026-55220

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-47193 OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1...

CVE-2026-47193 OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1...

CVE-2026-57287

Jenkins Job Configuration History Plugin 1356.ve360da6c523a and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted...

PT-2026-47617

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.2 Description The TDengine DAQ storage connector contains a flaw in the escapeTdString function located in server/runtime/storage/tdengine/index.js. While the function doubles single quotes, it fails to escape...

CVE-2025-15638

Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437...

AI Used to Decrypt Medieval Ciphers

Researchers are using machine learning algorithms to decrypt historical pencil-and-paper ciphers...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a remote code execution backdoor and an advanced credential stealer. A malicious actor exploited remapped historical tags to commit malicious commits, retroactively compromising over 700 versions of...