domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

cloudlist

Features • Installation • Usage • Configuration • Running cloudlist • Supported providers • Library • Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...

nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling

A flaw was found in Node.js. This vulnerability in the TLS Transport Layer Security hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose...

nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames

A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...

nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling

A flaw was found in Node.js. This vulnerability in the TLS Transport Layer Security hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose...

nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames

A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...

CVE-2026-119760

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then clo...

CVE-2026-119760 sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then clo...

CVE-2026-119760

The sniproxy daemon, version 0.7.0 and prior, contains a NULL pointer dereference vulnerability within the resolv_cancel() function. This flaw allows remote unauthenticated attackers to crash the service by providing overlong hostnames , specifically 254 or 255 character TLS SNI names or HTTP Hos...

CVE-2026-119760 sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then clo...

CVE-2026-119760: dlundquist sniproxy: sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote…

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then clo...

nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames

A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...

Node.js TLS Noncanonical IP DNS SAN Acceptance Checker

Node.js versions 22.x, 24.x, and 26.x contain an improper certificate validation issue involving non-canonical IPv4 hostnames. This offline tool assesses operator-supplied Node.js version evidence against the fixed releases...

Node.js TLS Certificate Validation Bypass

Node.js versions before 22.23.4, 24.22.1, and 26.12.1 improperly validate TLS certificates for noncanonical IPv4 hostnames, allowing a numeric DNS SAN to authenticate an IP endpoint. This advisory provides affected-version and precondition research...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

EUVD-2026-108959

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

PT-2026-122083

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames

A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Improper Certificate Validation for Non-Canonical IPv4 Hostnames

Improper Certificate Validation for Non-Canonical IPv4 Hostnames vulnerability discovered by br41ny in WordPress npm Node.js versions 22.23.4...