CVE-2026-105696

The Penpot design and prototyping platform is vulnerable to a page-scope escalation in versions prior to 2.18.0 . The get-page and get-file-fragment RPC commands fail to verify if a requested page-id or fragment belongs to the authorized set of a provided share-link permission object. An authenti...

CVE-2026-105693

The open-source design and prototyping platform Penpot is vulnerable to an anonymous share-link token disclosure and page-scope bypass in versions prior to 2.18.0 . The unauthenticated get-view-only-bundle RPC incorrectly returns every share-link row for a file, even when a caller authenticates w...

CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105684

Prior to version 2.18.0 , the Penpot design and prototyping platform is vulnerable to a page-scope escape in its comment RPC commands. Specifically, the get-comment-threads, get-comment-thread, and get-comments commands fail to enforce share link page restrictions, even though they perform permis...

CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105633

The open-source project management tool Plane is vulnerable to an authorization bypass in the V2 issue-attachment PATCH endpoint prior to version 1.4.0 . The root cause is that the server accepts an issue_id in the URL but fails to include it in the database query, matching only on pk, workspace,...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

CVE-2025-6554

CVE-2025-6554 function leakhole let x; delete x?.y?.a; return y; let y; function pwn let hole = leakhole; %DebugPrinthole; pwn; 漏洞 变量 y 在声明之前被访问。正常情况下这会触发 ReferenceError（暂存死区，TDZ），但在旧版 V8 中，当与 delete x?.y 结合使用时，检查失败并返回内部哨兵值 "The Hole"。 补丁前 V8 仅检查了一次 TDZ，然后错误地假设 y 是有效的。这使得 "The Hole" 逃逸到用户代码中。 修复...

project-black

Project Black 范围控制、范围扫描器和进度追踪器，用于更轻松地处理漏洞众测或渗透测试项目 Anatoly Ivanov，Positive Technologies 这个工具是做什么用的？ 该工具鼓励在渗透测试/漏洞众测中采用更有条理 的方法，追踪进度和通用的扫描信息。 它可以启动 masscan nmap dirsearch amass patator 针对你工作的范围，并将数据以方便的形式存储。对项目数据执行有用的过滤，例如： 查找所有具有开放端口但不是80端口的主机 查找所有IP以82开头的主机 查找 dirsearch 至少发现一个200状态码文件的主机 安装 通过...

ipa-scope

IPA-SCOPE v.2 IPA-SCOPE 是一个针对 iOS 应用的静态分析工具，能够提取重要信息，如链接、有趣的文件（.json, .cer, .der, .api 等），在渗透测试 iOS 应用时非常有用，能展示良好的结果。 此工具的新功能 ✅快速且易于使用 ✅获取二进制信息（如 API 密钥、子域名等） ✅保存并显示过滤结果 ✅获取目标应用中的链接库 ✅获取应用中的所有字符串和类 要求： Linux 或 Mac OS 安装： git clone https://github.com/xcodeOn1/ipa-scope.git sudo pip3 install -r...

CVE-2020-0796

CVE-2020-0796 Windows SMBv3 本地特权提升漏洞利用 作者 Daniel García Gutiérrez @danigargu Manuel Blanco Parajón @dialluvioso 漏洞利用分析 PoC分析 by SungLin 知道创宇404团队 Writeup+PoC by @ZecOps 参考 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796...

Vulnerability-Disclosures

Divulgaciones de Vulnerabilidades de Mandiant Este repositorio detalla las vulnerabilidades divulgadas por Mandiant. Estas vulnerabilidades fueron descubiertas mediante investigación interna, evaluaciones de Red Team, o en uso activo en el entorno salvaje. Las pruebas de concepto PoCs pueden o no...

KingOfBugBountyTips

KingOfBugBountyTips 终极漏洞赏金侦察武器库 "暗影中狩猎，代码中信任" Telegram | Twitter | YouTube | LinkedIn DoD VDP 范围 DoD Vulnerability Disclosure Program | KingRecon DOD 完整 DoD 范围 - 19 个域名 bash BBRF Scope - All DoD Domains bbrf inscope add '.af.mil' '.army.mil' '.marines.mil' '.navy.mil' '.spaceforce.mil' '.ussf.mil...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

SCOPE

SCOPE: 安全云运营紫色演练 SCOPE 利用确定性 Python 清单和有界 AI 代理运行 AWS 紫队工作流。它审计 AWS 资源，验证攻击路径，生成仅用于审查的利用剧本，生成控制措施，并指导 Splunk 调查。 工作原理 从 Claude Code、Antigravity CLI、Gemini CLI 或 Codex CLI 运行 SCOPE： /scope:audit --all 阶段| 输出 ---|--- 审计| Python 枚举器清单：IAM、STS、S3、KMS、Secrets Manager、Lambda、EC2、ECS、RDS、API...

bbot

BEE·bot is a multipurpose scanner inspired by Spiderfoot, built to automate your Recon , Bug Bounties , and ASM! https://github.com/blacklanternsecurity/bbot/assets/20261699/e539e89b-92ea-46fa-b893-9cde94eebf81 A BBOT scan in real-time - visualization withVivaGraphJS Installation stable version...

APTS

什么是 OWASP APTS？ 自主渗透测试平台的治理标准。它定义了这些系统必须做什么才能安全、透明地在既定边界内运行，无论它们是由供应商交付、作为服务运营，还是由企业安全团队内部构建用于测试自己的组织。 APTS 不是一种测试方法论。它通过应对自主操作特有的问题来补充 PTES、OWASP WSTG 和 OSSTMM：范围执行、安全自主、防操纵和问责制。 8 个领域的 173 个层级要求 域| 前缀| 要求数量| 描述 ---|---|---|--- 范围执行| SE| 26| 定义、验证和强制测试边界 安全控制| SC| 20| 影响分类、爆炸半径、终止开关、回滚、执行沙箱 人类监督...

quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

bbscope

bbscope.com 用于聚合来自 HackerOne、Bugcrowd、Intigriti 和 YesWeHack 的漏洞赏金计划范围的 Web 界面和 API。 快速开始 Docker cd website cp .env.example .env 编辑 .env — 至少设置 POSTGRESPASSWORD 和你的平台凭证 docker compose up -d --build 站点将通过 https://yourdomain.com 访问（Caddy 通过 Let's Encrypt 自动处理 HTTPS）。 Cloudflare DNS 挑战 如果你的服务器位于...