CVE-2026-107203

The Foreman package contains an incorrect authorization flaw in its network interface handling . The domain and subnet interface API fails to apply search limits on host permissions, allowing a low-privileged network attacker to view interface records for hosts they are not authorized to access. ...

CVE-2026-107193

A flaw exists in the permission filters of the foreman package. The API loads a filter via its identifier but fails to apply the search limit corresponding to the caller's permissions. A low-privileged network attacker or user who is authorized to delete filters for only one role can exploit this...

CVE-2026-107203

An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...

goscan

GoScan es un cliente interactivo de escaneo de redes, con autocompletado, que proporciona abstracción y automatización sobre nmap. Aunque comenzó como un pequeño proyecto paralelo que desarrollé para aprender @golang, GoScan ahora se puede usar para realizar descubrimiento de hosts, escaneo de...

eternal_scanner

ETERNAL SCANNER 2.4 Eternal scanner es un escáner de red para el exploit Eternal Blue CVE-2017-0144 y Eternal Romance tubería con nombre CVE-2017-0145 . Capturas de pantalla Versión 2.2 Nuevas implementaciones Verificación de vulnerabilidad Eternal Romance escan -er Resultados divididos de la bas...

fscan

Fscan English Herramienta integral de escaneo de redes internas, escaneo automatizado de vulnerabilidades con un solo clic. Versión : 2.2.2 Características Capacidades de escaneo Descubrimiento de hosts - Detección de supervivencia ICMP/Ping, soporta estadísticas de supervivencia en segmentos de...

pi-hole

Bloqueo de anuncios en toda la red mediante tu propio hardware Linux Pi-hole® es un sumidero de DNS que protege tus dispositivos de contenido no deseado sin necesidad de instalar software en el cliente. Fácil de instalar : nuestros diálogos te guían a través del sencillo proceso de instalación en...

dismap

🌀 Dismap - Herramienta de descubrimiento e identificación de activos 中文 Readme Dismap se posiciona como una herramienta de descubrimiento e identificación de activos. Puede identificar rápidamente protocolos e información de huellas digitales como web/tcp/udp, localizar tipos de activos y es...

PT-2026-110470

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description An incorrect authorization flaw exists in the network interface handling of the Foreman package. The domain and subnet interface API verifies if the caller has host permission but fails to...

CVE-2026-109177: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109175: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

CVE-2026-108950: Missing Authorization

Open Source Social Network OSSN through 10.1 contains a missing authorization vulnerability in ossnalbumpagehandler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos an...

CVE-2026-108901: Improper Restriction of Rendered UI Layers or Frames

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...

CVE-2026-109332: Origin Validation Error

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109331: Interpretation Conflict

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP...

CVE-2026-109330: Missing Origin Validation in WebSockets

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page th...

CVE-2026-83536: Uncontrolled Resource Consumption

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-108362: Origin Validation Error

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence...

CVE-2026-83535: Observable Timing Discrepancy

A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security TLS, the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open...

CVE-2026-85957: Improper Restriction of XML External Entity Reference

Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure...