OSIF

this project will be stopped for some time to come. root@kitploit: o' .=./ o o o ooO----Ooo O S I F open source information facebook OSIF is an accurate facebook account information gathering, all sensitive information can be easily gathered even though the target converts all of its privacy to...

Instagram-Notes-Audio-Leakage-via-URL-Extraction-Fixed

🎙️ Instagram Notes Audio Leakage via URL Extraction Fixed & Rewarded 🛡️ Vulnerability Summary In 05/2025, I discovered a vulnerability in Instagram Web that allowed any user to extract the original video file from a Note and access the background audio , which was not meant to be publicly...

fbht

FBHT Facebook Hacking Tool Python - -version 2.7.3 Windows/Linux IMPORTS Selenium Matplotlib-1.2.1 Networkx-1.8.1 Numpy-1.7.1 Pygraphviz-1.1 Simplejson-3.3.0 Mechanize-0.2.5 Other: gephi-0.8.2-beta Graphs software Recomendation: Use setuptools for the dependencies S.O Working on Windows 7 64/32...

CVE-2026-86111

BookWyrm through version 0.9.1 contains an Insecure Direct Object Reference (IDOR) in the status edit endpoint. The root cause is a failure to validate user visibility permissions, allowing any authenticated attacker to read followers-only and direct-message reviews by enumerating sequential stat...

CVE-2026-86111 BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. Setup.exe – Cadenas de Privacidad, Controladores y Memoria El análisis de memoria con Process Hacker del dropper setup.exe revela que Lumma Stealer apunta a configuraciones de privacidad, instala controladores y gestiona memoria. Cadenas clave observadas: Privacy Camera – Intenta acceder o...

CVE-2026-78380

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

EUVD-2026-64857

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

CVE-2026-13736

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

UBUNTU-CVE-2026-74962

Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74962

Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-39309

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...

CVE-2026-28988

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An app may be able to bypass certain Privacy preferences...

EUVD-2026-29282

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An app may be able to bypass certain Privacy preferences...

About the security content of visionOS 26.5

About the security content of visionOS 26.5 This document describes the security content of visionOS 26.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

About the security content of macOS Tahoe 26.5

About the security content of macOS Tahoe 26.5 This document describes the security content of macOS Tahoe 26.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

About the security content of iOS 26.5 and iPadOS 26.5

About the security content of iOS 26.5 and iPadOS 26.5 This document describes the security content of iOS 26.5 and iPadOS 26.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

PT-2026-28531

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description The objects/playlistsVideos.json.php endpoint does not enforce authentication or authorization checks, allowing access to the full video contents of any playlist by its ID. While private...

Security Bypass Vulnerability in Multiple Apple Products

Apple iOS is an operating system developed for mobile devices.Apple macOS is a specialized operating system developed for Mac computers.Apple iPadOS is an operating system for iPad tablets. A security bypass vulnerability exists in multiple Apple products, which can be exploited by an attacker to...

CVE-2026-28559

wpForo Forum 2.4.14 has an information disclosure flaw in the global RSS feed endpoint that allows unauthenticated access to private and unapproved topics. Requesting the RSS feed without a forum ID bypasses privacy and status filters that are applied when a specific forum ID is present, exposing...