CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

de4dot

Description de4dot is an open source GPLv3 .NET deobfuscator and unpacker written in C. It will try its best to restore a packed and obfuscated assembly to almost the original assembly. Most of the obfuscation can be completely restored eg. string encryption, but symbol renaming is impossible to...

CVE-2026-11399 Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

whodunit

whodunit Recognizing the most likely APT groups responsible for an incident Description This program takes a report from a cybersecurity incident containing the MITRE ATT&CK techniques that have been detected to have been used in the incident and tries to recognize which APT groups are the most...

cisco-CVE-2023-20198-tester

Cisco Tester: Script de detección de vulnerabilidades Tabla de contenidos Resumen Características Requisitos previos Instalación Uso Salida Contribuciones Resumen El script ciscotester.py está diseñado para evaluar múltiples direcciones IP en busca de una vulnerabilidad específica de Cisco...

CVE-2026-86834: Exposure of Sensitive Information to an Unauthorized Actor

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

PT-2026-104526

Name of the Vulnerable Software and Affected Versions MetForm WordPress plugin versions prior to 4.3.1 Description When the HubSpot Forms integration is enabled, the plugin fails to properly restrict access to a debug file created in the web root during every form submission. This allows...

Linux Distros Unpatched Vulnerability : CVE-2026-102731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing...

untitledgoosetool

Untitled Goose Tool The Goose is loose. Table of Contents About Getting Started Prerequisites Requirements Installing Usage Config GUI Auth Csv Honk Messagetrace Recommended Default Workflow Recommended Workflow for UAL Call with Time Bounds Considerations Known Issues Acknowledgements Contributi...

PoC-CVE-2025-69420

CVE-2025-69420 — OpenSSL TimeStamp Response type confusion PoC Crash-only laboratory reproducer for CVE-2025-69420 in OpenSSL. The PoC loads a valid RFC 3161 TimeStamp Response, changes the signed ESS attribute from VASN1SEQUENCE to VASN1NULL in memory, and calls TSRESPverifyresponse. On an...

CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

ShuckNT

🔐 ShuckNT : Shuck hash before trying to crack it | Shuck.sh's script ShuckNT is the script of Shuck.sh online service for on-premise use try it online!. It is design to dowgrade, convert, dissect and shuck authentication token based on Data Encryption Standard DES. Algorithms / formats supported ...

CVE-2026-94543

A flaw was found in Next.js. In self-hosted applications using the Pages Router with static generation or Incremental Static Regeneration ISR, response cache entries are not sufficiently bound to their source route. A remote attacker can exploit this issue by sending crafted requests to replace a...

WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary Ticket Response Deletion vulnerability discovered by Saruul in WordPress Plugin Helpdesk Support Ticket System for WooCommerce versions = 2.1.6...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...

aiiroverlay

Why an overlay, not a replacement. The thesis. Part of the AI IR Overlay™ framework. SeeCONTENTMAP.md for the full repository map. The AI IR Overlay: Framework Overview Current release: v0.35.0 · 2026-07-09 · CHANGELOG A practical incident-response baseline for AI agents in production. Adapt and...

rewrite-cve-2026-22732

rewrite-cve-2026-22732 OpenRewrite recipe that detects code susceptible to CVE-2026-22732, a Spring Security defect where setting Content-Length through one of three response methods bypasses Spring Security's OnCommittedResponseWrapper. Because the wrapper never sees the header,...

DEBIAN-CVE-2026-102731

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-102731

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...