203949 matches found
CVE-2026-119566
A flaw was found in Prometheus. This vulnerability allows an attacker who controls a configured remote write endpoint or redirecting server to cause an information disclosure. By returning an HTTP redirect response to an arbitrary host, the server can induce Prometheus into forwarding sensitive...
Important: Red Hat Security Advisory: freerdp security update
An update for freerdp is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU
A flaw was found in FreeRDP. This information disclosure vulnerability exists in the RDPGFX server's ResetGraphics Protocol Data Unit PDU serializer. It fails to properly initialize padding bytes, allowing a remote attacker to receive uninitialized heap memory. This can lead to the disclosure of...
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure
A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol RDP server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This...
CVE-2026-18800
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured...
pcc
PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...
CVE-2025-13647
Multiple WSO2 products are vulnerable to an information disclosure vulnerability due to insufficient validation of the content-type header during request processing. An attacker can submit a crafted request with a manipulated header to expose the file paths for certificate files . This disclosure...
CVE-2026-118759
A flaw was found in Kubeflow Pipelines. An unauthenticated remote attacker with access to the API server can retrieve execution logs without proper authorization checks. By submitting requests with known workflow run and pod identifiers, an attacker can access live or archived logs from targeted...
CVE-2026-57193
A flaw was found in Asterisk's resconfigldap module. An unauthenticated remote attacker can exploit this flaw to cause information disclosure through Lightweight Directory Access Protocol LDAP filter injection. By sending specially crafted Session Initiation Protocol SIP packets with a manipulate...
RepoReaper
RepoReaper Overview RepoReaper is a precision tool designed to automate the identification of exposed .git repositories across a list of domains and subdomains. By processing a user-provided text file with domain names, RepoReaper systematically checks each for publicly accessible .git files. Thi...
gitlab-component
gitlab-component Getting started To make it easy for you to get started with GitLab, here's a list of recommended next steps. Already a pro? Just edit this README.md and make it your own. Want to make it easy? Use the template at the bottom! Add your files Create or upload files Add files using t...
CVE-2026-119210
A flaw was found in MariaDB Connector/J. This vulnerability can lead to information disclosure when client-side local file handling is enabled. A compromised database server or a machine-in-the-middle attacker can provide crafted database or table identifiers that bypass filename validation check...
CVE-2025-14847
🍃 CVE-2025-14847 — MongoBleed 🍃 MongoBleed — MongoDB Server Memory Disclosure Vulnerability 🍃 Overview CVE-2025-14847, known as MongoBleed , is a security vulnerability affecting MongoDB Server's handling of compressed network messages. Under vulnerable conditions, an unauthenticated remote...
Malicious code in bigbob22-test (npm)
[email protected] has no functional code and an empty README. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...
Malicious code in ms-client-portal (npm)
ms-client-portal is a dependency-confusion package with no functional code; its README says the name is an internal project name exposed in the production web bundle of a health-sector client portal. Its preinstall and postinstall scripts each run a node -e one-liner on npm install that sends an...
Malicious code in calculator-preinstall-hook-demo (npm)
[email protected] presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook...
Malicious code in zystcdemo (npm)
zystcdemo presents itself as a simple date formatting utility and runs its postinstall payload on npm install with node postinstall.js. The payload collects the whoami result, hostname, platform, and current time, then sends them in a POST request to https://srctest.zystcc.cn/collect; npm account...
Malicious code in claims-ac1 (npm)
claims-ac1 1.0.0 contains only a package.json declaring a single dependency, node-ac2, that is not fetched from the npm registry but from a tarball in the GitHub repository GamerD11/pingtest https://github.com/GamerD11/pingtest/raw/main/node-ac2.tgz. That tarball has no code and in turn depends o...
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure
A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol RDP server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This...
DotGit
DotGit An extension for checking if .git is exposed in visited websites Features Check if a .git/.svn/.hg folder exists for each site you visit Check if a .env file exists for each site you visit Check if a .DSStore file exists for each site you visit Check if the site is open source github/gitla...