Cerberus

Cerberus A powerful vulnerability scanner. Subdomain enumeration uses aioDNS with asyncio for asynchronous fast scanning. It covers the target's full asset scope for batch vulnerability scanning, middleware information collection, automatic proxy IP collection, and automatically uses proxy IPs to...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2025-38004 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcmop runtime updates The CAN broadcast manager CAN BCM can...

CVE-2026-13157

CVE-2026-13157 Theme Demo Import false during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary...

yalu102

yalu102 A "work in progress" iOS jailbreak for 64-bit devices created by qwertyoruiopz and marcograssi. Please use the "Issues" tab for code related issues only. If you need support please search on /r/jailbreak before posting a question there. Supported Devices and iOS versions Device| Version...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite Checkpoint SQL Injection CVE-2025-67644 is a SQL Injection vulnerability CWE-89 in the langgraph-checkpoint-sqlite package part of LangGraph / LangChain ecosystem. It allows an attacker to inject arbitrary SQL via unsanitized metadata filter keys passed to th...

vulpy

Vulpy - Web Application Security Lab Vulpy is a web application developed in Python / Flask / SQLite that has two faces. GOOD : Tries to code with secure development best practices in mind. BAD : Tries to code like possibly you. :p Is developed has a laboratory for the following courses: Secure...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

CVE-2026-114509

The Laravel web application framework is vulnerable to an authentication bypass in versions prior to 12.68.0 and 13.29.0 . When TokenGuard is configured as a standard token-based API guard, it fails to reject crafted non-string credentials . In specific MySQL or MariaDB configurations, this flaw ...

CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...

EUVD-2026-107583

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...

Project-CVE-2025-54068

Livewire2025CVE Livewire CVE-2025-54068 Scanner Automated vulnerability scanner for detecting CVE-2025-54068 in Laravel applications using Livewire v3.0.0-beta.1 through v3.6.3. Overview This tool scans a list of websites for indicators of the critical Livewire remote code execution vulnerability...

CVE-2026-24061-payload

Original source:https://github.com/K3ysTr0K3R/CVE-2026-24061 CVE-2026-24061 - GNU InetUtils telnetd Argument Injection Authentication Bypass GNU InetUtils versions 1.9.3 through 2.7 are vulnerable to a remote authentication bypass vulnerability in the telnetd server. The telnetd daemon fails to...

kit-policy

kit-policy A flexible, composable authorization framework for Kit, inspired by Ruby's Action Policy. TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit...

CVE-2026-5513

CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie Overview Field| Value ---|--- CVE ID| CVE-2026-5513 Vulnerability| Stored Cross-Site Scripting XSS Plugin| Bookly — Online Scheduling and Appointment Booking System Affected| ≤ 27.2 Patched| 27.3+ CVSS 3.1| 7.2 High —...

recollapse

REcollapse REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications. It can also be helpful to bypass WAFs and weak vulnerability mitigations. For more information, take a look at the REcollapse blog post. The goal of this tool ...

CVE-2026-47670

CVE-2026-47670 Authenticated Remote Code Execution via loadReader functionName code injection in DbGate DbGate is an open-source, cross-platform database management tool designed for developers and database administrators who need to work with multiple database systems simultaneously. It provides...

CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass Vulnerability This repository demonstrates the CVE-2025-29927 vulnerability in Next.js where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Vulnerability Details Next.js uses an internal header...

struts-uploader-vulnerability

CVE-2024-53677 — How the Exploit Works and How to Run It Vulnerability summary The flaw is in how Struts' FileUploadInterceptor hands off the uploaded filename to the action class. Normally the interceptor sanitizes the filename, but Struts also lets any multipart parameter be processed as an OGN...

CVE-2026-92247

SynaptikCMS File Manager — Authenticated RCE Vulnerability SynaptikCMS File Manager Authenticated Remote Code Execution SynaptikCMS's file manager allows an authenticated attacker to upload a file and subsequently rename it to a PHP file. This upload and rename behavior can be abused to place...

awesome-ctf

Awesome CTF A curated list of Capture The Flag CTF frameworks, libraries, resources, softwares and tutorials. This list aims to help starters as well as seasoned CTF players to find everything related to CTFs at one place. Contributing Please take a quick look at the contribution guidelines first...