disclo

disclo Domain contact finder. Give it a domain, get every email, handle, and lead associated with it - across 12 passive sources, in parallel. $ python disclo.py gitlab.com disclo - gitlab.com ---------------------------------------------------------------------- hackerone...

Insertion of Sensitive Information into Log File

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the collectSecretRedactions function in NunjucksWorkflowRunner.ts, which fails ...

Improper Neutralization of Special Elements Used in a Template Engine

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via insufficient...

Server-side Request Forgery (SSRF)

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the sanitizeMkdocsYml function in mkdocsPatchers.ts,...

joern

Joern Query Database "Joern-Scan" This is the central query database for the open-source code analysis platform Joern. It has two purposes: It provides the batteries required to turn Joern into a ready-to-run code scanning tool. Its queries serve as examples useful for those looking to write thei...

ish

iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...

CVE-2026-107166

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

GHSA-W7X8-Q2GP-5CGG Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Summary Flowise = 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist validatePythonCodeForDataFrame to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an extern...

Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Summary Flowise = 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist validatePythonCodeForDataFrame to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an extern...

GHSA-9GVV-QJJ3-2P6G Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...

GHSA-R5MF-4R5X-Q78F Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty ar...

GHSA-68JQ-FHCH-4XQ4 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...

GHSA-PQ96-JPMF-W254 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js lines 149-176: getAttr and getHead Sink: injectServerMeta same file → ctx.headTags += getHeaddata, interpolated verbatim into the raw HTTP response by the production SSR template...

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js lines 149-176: getAttr and getHead Sink: injectServerMeta same file → ctx.headTags += getHeaddata, interpolated verbatim into the raw HTTP response by the production SSR template...

GHSA-WMPW-J6QV-MW88 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Vulnerability Details File: icongenie/lib/utils/get-assets-files.js line 35, absoluteName: joinappDir, asset.folder, asset.name Validation gap: icongenie/lib/utils/validate-profile-object.js assetsSchema — folder/name only checked with Joi.string.required.min1, no restriction on .. sequences or...