typodetect

TypoDetect This tool gives blue teams, SOC's, researchers and companies the ability to detect the active mutations of their domains, thus preventing the use of these domains in fraudulent activities, such as phishing and smishing. For this, Typodetect allows the use of the latest available versio...

brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

ida-pro-mcp

IDA Pro MCP ⚠️ Archived — superseded by the official Hex-Rays IDA MCP server This project is no longer maintained. On 2026-09-27 Hex-Rays SA released the Official IDA MCP Server and IDA Nexus. Development stopped the same day at 1.0.0a4. For current use, install theirs: uvx ida-hcli mcp install. I...

lago-invite-ato

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lago-invite-ato lago-invite-ato Lago v1.53.0 - GetLago Mutations::Invites::Accept has no AuthenticableApiUser. Create/revoke do. Accept does not. registerfrominvite loads the user by invite email. If that account...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776

Craft CMS versions 5.0.0 through 5.11.0 are vulnerable to a GraphQL Site-Scope Bypass via mutations. The root cause is the failure to enforce the requireAllowedSite() function, allowing site-scoped GraphQL tokens to interact with content from other sites. An attacker holding a valid token for one...

mutiny-fuzzer

Inicio rápido: Tutorial de Mutiny Publicación del blog aquí: http://blog.talosintelligence.com/2018/01/tutorial-mutiny-fuzzing-framework-and.html Enlaces a esta demostración en video de YouTube: https://www.youtube.com/watch?v=FZyR6MgJCUs Para más características orientadas a campañas de...

CVE-2026-107813 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

CVE-2026-107813: Missing Authorization

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

CVE-2026-107450

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smartlists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...

CVE-2026-107450

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smartlists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...

CVE-2026-107450

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smartlists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...

CVE-2026-107450

In Stump versions through 0.1.10 , an authorization flaw in the updateSmartList and deleteSmartList GraphQL mutations (located in crates/graphql/src/mutation/smart_lists.rs) allows for unauthorized data manipulation. The vulnerability exists because these mutations rely solely on the shared Acces...

CVE-2026-107450: Incorrect Authorization

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smartlists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...

PT-2026-107807

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smart lists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...

BIT-JOOMLA-2026-90913 Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260903 - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints...

stump-smartlist-bola

Stump: Smart List Takeover via Broken Access Control BOLA...

CVE-2026-100592

The OpenClaw agent gateway (distributed via npm) versions >= 2026.4.10 and

CVE-2026-100591

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...