PT-2026-104655

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http connection in lib/gist.rb sets VERIFY NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth toke...

CVE-2026-104286-POC

Exploit de Path Traversal en FortiMail CVE-2026-104286 Descripción general Exploit avanzado de escritura arbitraria de archivos remota y no autenticada para CVE-2026-104286 en FortiMail. Las solicitudes HTTP/HTTPS manipuladas eluden la sanitización de rutas en el cliente web, lo que permite la...

CVE-2026-13249

CVE-2026-13249 — Carga de archivos sin autenticación en Honeywell PD45 RCE PoC en Python 3 para CVE-2026-13249 — interfaz de administración web de la impresora industrial Honeywell PD45. Descripción PoCbit / GitHub CVE-2026-13249 — El firmware F10.19.010040 hasta antes de F10.22.030745 expone una...

EUVD-2026-91837

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu versions prior to 3.0.0 are vulnerable to a missing authentication flaw in the Playground feature. This vulnerability allows unauthenticated attackers to proxy arbitrary HTTP and HTTPS requests to URLs on the public internet. No specific exploit details or remediation steps are provid...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

zoshrinkC2

MeliziaC2 Malware dirigido que usa DNS-over-HTTPS solo se ejecuta una vez ! Algunas funciones aún no están disponibles ! ! WIP, no usar en producción ! Características principales Autoeliminación del malware en caso de fallo Comunicación DoH DNS-over-HTTPS totalmente cifrada clave RSA por víctima...

CVE-2026-104459

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

Lack of vulnerability protection in Fortinet FortiMail

Fortinet has identified a vulnerability in FortiMail. FortiMail contains a critical vulnerability CVE-2026-104286 in the processing of file paths, caused by a combination of Path Traversal CWE-22 and insufficient neutralization of NULL bytes CWE-158. An unauthorized attacker can use specially...

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The U.S. Cybersecurity and Infrastructure Security Agency CISA, on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 CVSS score: 9.8,...

https-everywhere

Update on HTTPS Everywhere ⚠️This project is no longer being maintained or updated. Please uninstall and direct users to the advice below to switch to HTTPS by default natively. You no longer need HTTPS Everywhere to set HTTPS by default! Major browsers now offer native support for an HTTPS only...

mitmengine

MITMEngine DEPRECATION NOTICE: This software is no longer maintained. The goal of this project is to allow for accurate detection of HTTPS interception and robust TLS fingerprinting. This project is based off of The Security Impact of HTTPS Interception, and started as a port to Go of their...

NSEC3-X

DISCLAIMER: This project was generated by Artificial Intelligence AI but has undergone a rigorous "Human-in-the-Loop" HITL process. This means the code has been reviewed and refactored by a human software engineer, the architectural design was human-directed, and a basic security audit was...

CVE-2026-105049: Missing Authentication for Critical Function

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

PT-2026-104452

Name of the Vulnerable Software and Affected Versions Zilliz Attu versions prior to 3.0.0 Description The Playground feature allows the proxying of arbitrary HTTP and HTTPS requests to URLs on the public internet without requiring authentication. This leads to a Server-Side Request Forgery SSRF, ...

CVE-2026-104286

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on th...

ca-clone

Scripts de Clonación de CA Scripts para clonar certificados de CA para su uso en ataques a clientes HTTPS. Actualmente se incluyen scripts para clonar una CA raíz de Comodo y una CA de Digicert, ambas ampliamente confiables en dispositivos IoT. Uso Ejecute cualquiera de los scripts directamente...