330023 matches found
Exploit for CVE-2026-8181
CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin...
CVE-2026-50554
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...
muad-dib v2.12.0
Installation | Usage | Features | VS Code | CI/CD Version francaise Why MUAD'DIB? npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond. MUAD'DIB combines 22 parallel scanners 278 detection rules, a...
laravel-threat-detection v1.7.2
Laravel Threat Detection Security monitoring and attack logging for Laravel. Detect and log SQL injection, XSS, RCE, directory traversal, bot scanners and/wp-admin-style recon probes — every hostile request recorded to your database with full application context. It's an IDS, not a WAF: it never...
ios-nehelper-enum-apps-0day
nehelper enumerate installed apps 0-day iOS 15.0 I've updated this code to avoid using Private API directly. Read more in my blog post. However, that means that now this code is iOS version-specific and possibly device model-specific. So if it doesn't work on your device, recalculate and update t...
CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...
EUVD-2026-70529
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...
CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...
CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...
CVE-2026-50554
Note Mark (open-source note-taking application) is vulnerable to unauthenticated disclosure of soft-deleted note metadata prior to v0.19.5 . The unauthenticated GET /api/books/{bookID}/notes endpoint accepts a deleted query parameter; when set to true, the service calls Unscoped() to bypass GORM'...
CVE-2026-56127
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...
CVE-2026-56128
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...
safety-awareness
Transfer Safety Awareness for Cross-Modal Safety Drift Official implementation of Transfer Safety Awareness for Cross-Modal Safety Drift in Multimodal Large Language Models EMNLP 2026 Findings. This repository contains the Qwen3-VL safety-awareness direction pipeline. It extracts a refusal-relate...
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
Summary The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore...
GHSA-78X9-FHHX-V2G6 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
Summary The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore...
CVE-2026-78676
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...
CVE-2026-56128
pfSense Plus before 26.07 and pfSense CE before 2.9.0 contain a stored cross-site scripting vulnerability in the firewall schedule editor. Authenticated users with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The v...
EUVD-2026-70498
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...
CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...
CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...