kerbrute

Kerbrute A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication Grab the latest binaries from the releases page to get started. Background This tool grew out of some bash scripts I wrote a few years ago to perform bruteforcing using the...

CVE-2026-116895

REDAXO versions before 5.21.5 are vulnerable to a cross-site request forgery (CSRF) vulnerability in the index.php file. The root cause is the backend's processing of the safemode GET parameter without validating a CSRF token . A successful attack occurs when an attacker lures a logged-in adminis...

CVE-2026-116895 REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safemode:...

October CMS - Remote Code Execution

October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safemode and cms.enableSafeMode in order to execute arbitrary cod...

CVE-2026-103929

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml settings from an untrusted local project before trust approval and striplocalonlysettings removes only fields marked globalonly. The unixdefaultfileshellargs,...

CVE-2026-103905

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...

CVE-2026-101301

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

CVE-2026-103905 Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...

EUVD-2026-100979

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...

CVE-2026-103905

The JTL-Shop administration backend is vulnerable to an unauthenticated plugin safe mode toggle due to an authentication middleware flaw. The system processes the plugin safe mode toggle on the admin logout route before verifying the user's authentication status. An unauthenticated remote attacke...

CVE-2026-103905 Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...

CVE-2026-101301 WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

CVE-2026-101301

The WPCode WordPress plugin (versions 2.0.0 through 2.3.9) is vulnerable to unauthenticated snippet suppression. The root cause is a failure to correctly verify if a request is genuinely for the login screen before entering snippet safe mode . This allows unauthenticated visitors to disable all o...

EUVD-2026-100974

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

CVE-2026-101301 WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

CVE-2026-103905: Missing Authentication for Critical Function

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...

PT-2026-113783

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

CVE-2026-101301: Improper Access Control

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

CVE-2026-49400

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-46696

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...