CVE-2026-126935

The Zipline software, in versions prior to 4.8.0 , is susceptible to a race condition vulnerability within the src/server/routes/raw/[id].ts component. This issue stems from non-atomic view counting , which allows remote attackers who possess a file link to bypass maxViews limits. By sending para...

CVE-2026-126935

Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/id.ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing...

CVE-2026-126935 Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/id.ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing...

CVE-2026-126932

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932

Zipline versions 4.6.2 before 4.8.0 are vulnerable to a policy bypass vulnerability. This flaw allows authenticated users to evade administrator-imposed restrictions on MIME types by manipulating file metadata. An attacker can upload a permitted file and subsequently use the PATCH /api/user/files...

CVE-2026-126932 Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

AzureRedOps

AzureRedOps A Swiss Army tool for Azure / Entra ID red teaming. Author: Mr.Un1k0d3r TrueCyber Inc Version: 0.1 Language: Python 3.12+ Overview AzureRedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID and Azure tenants. It wraps the most common red-team...

GHunt

🌐 GHunt Online version : https://osint.industries 🐍 Now Python 3.13 compatible ! 😊 Description GHunt v2 is an offensive Google framework, designed to evolve efficiently. It's currently focused on OSINT, but any use related with Google is possible. Features : CLI usage and modules Python library...

CVE-2023-49968

CVE-2023-49968 Customer Support System 1.0 - SQL Injection Vulnerability in managedepartment.php via "id" URL Parameter Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. An attacker with malicious intent can execute SQL commands on the MySQL database ...

CVE-2023-40931-PoC

CVE-2023-40931 The sqlmap payload to exploit CVE-2023-40931 Payload Required Information: Valid Username and Password Domain and path of hosted instance sqlmap -D nagiosxi -T xiusers -u "https:///nagiosxi/admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id=3&token=curl -ksX POST...

CVE-2026-65965

ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/id/ resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. T...

MAAD-AF

MAAD Attack Framework MAAD-AF is an open-source cloud attack tool for Microsoft 365 & Entra IDAzure AD environments. MAAD-AF offers simple, fast and effective security testing. Validate Microsoft cloud controls and test detection & response capabilities with a virutally zero-setup process, comple...

Vulnerable-to-Debian-OpenSSL-bug-CVE-2008-0166

Search for BTC coins on earlier versions of Bitcoin Core with critical vulnerability OpenSSL 0.9.8 CVE-2008-0166 In this article, we will create a tool that will generate Bitcoin Addresses P2PKH using the CVE-2008-0166 vulnerability. This is a research project to find BTC coins on earlier version...

CVE-2026-0300

🚨 CVE-2026-0300 - Critical Unauthenticated Remote Code Execution in Palo Alto Networks PAN-OS Buffer Overflow in User-ID™ Authentication Portal Captive Portal — Actively Exploited in the Wild 📋 Overview A critical buffer overflow vulnerability CWE-787 in the User-ID Authentication Portal of PAN-O...

EUVD-2026-124030

ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/id/ resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. T...

CVE-2026-65965

The self-hosted visual workspace ideon is vulnerable to an authorization bypass in versions prior to 0.9.4 . While the application correctly identifies the caller's project role, it fails to enforce permissions on several project mutation endpoints under /api/projects/[id]/*. This allows a user w...

CVE-2026-65965

ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/id/ resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. T...

CVE-2026-65965 ideon: Read-only project viewers can wipe and rewrite the canvas and tamper with blocks/files via role-unchecked project endpoints

ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/id/ resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. T...

EntraFalcon

EntraFalcon EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment. Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and...

CVE-2026-126801 Rote 1.2.0 through 2.6.0 Account Takeover via OAuth Account Merge Endpoint

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and...