domestic-system

The Domestic System A beautiful, terminal-based Ethereum wallet and smart contract browser built for sovereignty, security, and style. ━━━━━━━━━━━━━━━━━━━━ domestic system ━━━━━━━━━━━━━━━━━━━━ Overview The Domestic System is a terminal user interface TUI designed for browsing Ethereum EVM account...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed in the Vulnerability Details section below. This bulletin provides information about the affected components and the...

CVE-2026-86259

CVE-2026-86259 - OpenMAIC 1.0.0: SSRF saliente no autenticada al servicio de metadatos en la nube mediante middleware fail-open y omisión de validación condicionada por el entorno Descripción general Verificado. Existe una cadena de explotación de dos tramos en el middleware de autenticación de...

NuReaper

NuReaper — NuGet Package Security Scanner ⚠️ Work in Progress — The project is actively developed. Core scanning engine is functional; database persistence, caching, and full test coverage are planned for upcoming iterations. NuReaper is a .NET 8 backend API that automatically analyzes the securit...

prowler v5.44.0

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

cve-2024-43425

CVE-2024-43425 Firmware info: Application name: Moodle Build version: moodle-4.4.1 Affected versions: 4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11 and earlier unsupported versions Download link: moodle-4.4.1 Description and Impact Attackers with permission to create or modify questions...

Cawdog

CAWODOG – IP Protection PoC for Python-Based Industrial AI CAWODOG Cat World Dominance Group is a playful but realistic proof-of-concept for protecting Python-based AI models deployed on offline industrial machines. The core idea: Take a small image classifier that detects dogs the “enemy” of...

dj

dj - Dynamic JS File Extractor 中文 | English dj intelligently detects dynamically loaded JavaScript files by statically analyzing website HTML and JS code, including webpack chunks, import lazy loading, and more. Features Deep analysis of website HTML and JS to extract dynamically loaded JavaScrip...

CVE-2026-97965

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN driver. When transmitting network packets on devices configured with Group Based Policy GBP metadata, the driver fails to properly initialize an internal stack variable if packet flags are omitted. This issue allows residual kern...

cve-2026-49352-poc

CVE-2026-49352 — 9router Hardcoded JWT Secret Authentication Bypass Table of Contents Overview Affected Versions Root Cause Analysis Repository Structure Requirements Usage Expected Output References Disclaimer Overview CVE-2026-49352 is a vulnerability in 9router, a self-hosted Node.js/Next.js...

ThreatIntel-Aggregator

Agregador de Threat Intel Una plataforma de threat intelligence autoalojada que agrega feeds RSS de más de 60 proveedores de seguridad, ejecuta triaje con IA, correlaciona los hallazgos con tu inventario de activos de RunZero y expone alertas accionables a través de un panel web en modo oscuro...

CVE-2024-27564

CVE-2024-27564 Descripción: Una vulnerabilidad en pictureproxy.php permite a atacantes remotos realizar peticiones arbitrarias inyectando URLs en el parámetro url. Esta vulnerabilidad SSRF puede explotarse sin autenticación, lo que la hace particularmente peligrosa. El código vulnerable está en e...

CVE-2026-87902

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-87902 CVE-2026-87902 — WordPress WordPress — WordPress Core 7.1.1 — WordPress WordPress Core is vulnerable to Local File Inclusion via the locatetemplate function in various versions up to, and including, 7.1.1. | ---|--- CVE|...

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability. id: CVE-2022-0429 info: name: W...

Apache Airflow - Unauthenticated Variable Import

Apache Airflow Airflow =2.0.0 and =2.0.0 and 2.1.3 does not protect the variable import endpoint which allows unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

SugarCRM 3.5.1 - Cross-Site Scripting

SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string aka a $key variable. id: CVE-2018-5715 info: name: SugarCRM 3.5.1 - Cross-Site Scripting author: edoardottt severity: medium description: SugarCRM 3.5.1 is vulnerable to cross-site...

Enigma NMS < 65.0.0 - Authenticated OS Command Injection

An OS command injection vulnerability in the discoverandmanage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an authenticated attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ipaddress variable within an snmpbrowser action. id:...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

Leantime < 2.4 - Authenticated SQL Injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...