CVE-2023-31308

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read...

CVE-2023-31308

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read...

EUVD-2023-60610

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read...

CVE-2026-82813

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

CVE-2026-82815

A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the argument X-Forwarded-For/X-Real-IP/True-Client-IP causes improper access controls. The attack can be initiated remotely. The...

CVE-2026-82811

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-79749

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, MCPHub's SSRF guard in src/utils/ssrf.ts uses a custom isBlockedIpv6 function that only checks for loopback,...

CVE-2026-79743

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-51726

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51729

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51727

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51728

Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51725

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51730

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Ciphey v0.12.1

➡️ Discord | Documentation ⬅️ Project ciphey ciphey is the next generation of decoding tools, built by the same people that brought you Ciphey. We fully intend to replace Ciphey with ciphey. ✨ You can read more about ciphey here https://skerritt.blog/introducing-ciphey/ ✨ How to Use The simplest...

electronegativity

Electronegativity ⚠️ 我们已不再积极维护此项目 ⚠️ 什么是 Electronegativity？ Electronegativity 是一个用于识别基于 Electron 的应用中的配置错误和安全反模式的工具。 它利用 AST 和 DOM 解析来查找与安全相关的配置，如白皮书《Electron 安全清单——开发者和审计者指南》中所述。 软件开发者和安全审计员可使用此工具来检测和减轻使用 Electron 开发应用时潜在的弱点及实现漏洞。使用 Electronegativity 仍需对 Electron（不）安全性有良好理解，因为该工具检测到的某些潜在问题需要手动调查。...

Malicious code in nextjsupdater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c72c588f940a53ee4432bb472a919af2dac7e6d86344c8427764f38d6412b93 The package presents itself as a Next.js update tool but its exported downloadAndRunUpdate function in index.js retrieves updater.hta from...

MAL-2026-15631 Malicious code in nextjsupdater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c72c588f940a53ee4432bb472a919af2dac7e6d86344c8427764f38d6412b93 The package presents itself as a Next.js update tool but its exported downloadAndRunUpdate function in index.js retrieves updater.hta from...

linux-root-kit

Acerca de Este Proyecto Este proyecto fue desarrollado como parte del curso de Digitale Forensik en la Technische Hochschule Deggendorf. Demuestra una investigación forense completa y una simulación de ataque que involucra: Un ataque de confusión de dependencias en Python utilizando un paquete...

CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...