1233 matches found
heartbleedscanner
Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...
nmap
Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...
hardcidr
hardCIDR Background A Linux Bash script to discover the netblocks, or ranges, in CIDR notation owned by the target organization during the intelligence gathering phase of a penetration test. This information is maintained by the five Regional Internet Registries RIRs: ARIN North America RIPE...
GO-2026-6497 vulnerabilities
Vulnerabilities for packages: maru, opentofu, helm-mapkubeapis, cluster-api-helm-controller, kube-arangodb, rancher-helm, manifest-tool, k8sgpt, xeol, kargo, k9s, cert-manager-cmctl, gitness, helm-push, helm-set-status, kyverno-notation-aws, tigera-operator, flux-helm-controller...
GO-2026-6499 vulnerabilities
Vulnerabilities for packages: maru, opentofu, helm-mapkubeapis, cluster-api-helm-controller, kube-arangodb, rancher-helm, manifest-tool, k8sgpt, xeol, kargo, k9s, cert-manager-cmctl, gitness, helm-push, helm-set-status, kyverno-notation-aws, tigera-operator, flux-helm-controller...
nodesub
NODESUB Nodesub is a command-line tool for finding subdomains in bug bounty programs. It supports various subdomain enumeration techniques and provides flexible options for customization. Features Perform subdomain enumeration using CIDR notation Support input list. Perform subdomain enumeration...
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...
Improper Isolation or Compartmentalization
Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in lib/helpers/shouldBypassProxy.js, which matches NOPROXY entries by exact host or IP and has no parsing for CIDR notation, so...
PT-2026-103485
Summary Axios supports proxy environment variables and evaluates NO PROXY exclusions in the Node.js adapter. CIDR-form NO PROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusi...
CVE-2026-100670
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...
EUVD-2026-65212
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by configdeniedpaths...
Astra Linux – Vulnerability in libjettison-java
A stack overflow in Jettison prior to v1.5.2 allowed attackers to cause a Denial of Service DoS attack through crafted JSON data...
Astra Linux – Vulnerability in libjettison-java
Those who use Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser runs on user-supplied input, an attacker may provide content that causes the parser to crash due to out-of-memory conditions. This vulnerability could potentially allow for...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter consumes significant memory when dealing with a string representation of a number in scientific notation with a large exponent...
Astra Linux - Vulnerability in libfastjson
json-c through version 0.14 is vulnerable to an integer overflow and an out-of-bounds write when processing a large JSON file, as demonstrated by printbufmemappend...
Astra Linux – Vulnerability in python-pymysql
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input, because keys are not escaped by escapedict...
CVE-2026-49030
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-90973
pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join, resolve, and normalize to interpret backslash-separated dot notation sequences as directory traversal,...
CVE-2026-49030
pathe (unjs) through version 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join(), resolve(), and normalize() to interpret backslash-separated dot notation sequences as ...
