754 matches found
mihari
mihari A query aggregator for OSINT based threat hunting. Mihari can aggregate multiple searches across multiple services in a single rule & persist findings in a database. Mihari supports the following services by default. Censys CIRCL passive DNS / passive SSL crt.sh dnstwister Fofa GreyNoise...
private-landing
Private Landing Learn authentication by building it right. Live Demo · Threat Model · Auth Flows · ADRs Demo note: The login endpoint is protected by adaptive PoW challenges — repeated failures return increasing proof-of-work difficulty. Cache-backed rate limiting is implemented and tested but no...
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus...
uefi_bootkit_softlanding
SOFTLANDING UEFI BOOTKIT — ARES-2026-0001 The first public documentation of the SoftLanding UEFI DXE bootkit — a multi-agent, cross-platform firmware implant that persists in SPI flash Ring -2, deploys kernel and userland agents, and survives OS reinstallation and BIOS updates. ⚡ QUICK CHECK — AR...
MAL-2026-16493 Malicious code in @client-web-next/ab-landing-form (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @client-web-next/ab-landing-form (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-85574
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...
CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...
CVE-2026-85574
The Unbounce Landing Pages WordPress plugin, in versions before 1.1.5 , is vulnerable to a Reverse-Proxy Target Hijack via the set_unbounce_domains function. The flaw exists because the plugin fails to perform proper authorisation checks when updating the configuration for its front-end proxy. Th...
CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...
EUVD-2026-83503
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...
CVE-2026-85574: Missing Authorization
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...
PT-2026-95756
Name of the Vulnerable Software and Affected Versions Unbounce Landing Pages WordPress plugin versions prior to 1.1.5 Description An authorization bypass exists when updating the configuration used by the front-end proxy. This allows any authenticated user, including those with subscriber-level...
CVE-2026-85198: Improper Neutralization of Special Elements used in an SQL Command
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-81781
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
CVE-2026-81781 WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
EUVD-2026-72650
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
CVE-2026-81781
Unbounce Landing Pages WordPress plugin (versions through 1.1.4 ) is affected by a Missing Authorization (Broken Access Control) vulnerability, allowing an attacker with low privileges to exploit incorrectly configured access control security levels. The CVSS 3.1 score is 7.1 (HIGH) , with a netw...
CVE-2026-81781 WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
CVE-2026-81781: Missing Authorization
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...