CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

advanced-port-scanner

Advanced Port Scanner — Live CVE + SearchSploit Edition A Pyt...

EUVD-2026-91056

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

Exploit for CVE-2026-104110

Unauthenticated information disclosure in FileRise Pro portal en...

CVE-2026-12542

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

CVE-2026-12545

A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...

CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103922

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-35517

CVE-2026-35517 - Ejecución Remota de Código en Pi-hole FTLDNS mediante Inyección de Nueva Línea TL;DR Una vulnerabilidad de Ejecución Remota de Código en el motor FTLDNS de Pi-hole versiones 6.0 a 6.5 permite a un atacante autenticado inyectar directivas de configuración arbitrarias de dnsmasq...

CVE-2026-34197

CVE-2026-34197 — Ejecución Remota de Código en Apache ActiveMQ Classic a través de la API Jolokia TL;DR Una vulnerabilidad de ejecución remota de código en Apache ActiveMQ Classic que permite a un atacante ejecutar código arbitrario invocando la operación MBean addNetworkConnectorString a través ...

CVE-2026-39842

CVE-2026-39842: OpenRemote Expression Injection RCE in Rules Engine TL;DR Critical remote code execution vulnerability in OpenRemote's Rules Engine allows authenticated users with write:rules role to execute arbitrary code on the server with root privileges. CVSS Score : 10.0 Critical CVSS Vector...

CVE-2026-39987

CVE-2026-39987 — Ejecución Remota de Código Pre-Autenticada en Marimo Python Notebook TL;DR Una vulnerabilidad de ejecución remota de código pre-autenticada en Marimo , un notebook Python de código abierto para ciencia de datos e IA/ML. El endpoint WebSocket de terminal /terminal/ws omite por...

jsmon

JSMon JSMon - JavaScript Change Monitor for BugBounty Using this script, you can configure a number of JavaScript files on websites that you want to monitor. Everytime you run this script, these files will be fetched and compared to the previously fetched version. If they have changed, you will b...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

lazybee

ABOUT TOOL : Lazybee tool is a python based script from which you can generate random wordlist for brutefocre attacks. This tool has a unique features like wordlist generating time calculation and direct .txt saving in current directory. This tool works on both rooted Android device and Non-roote...

neurax

自己拡散ソフトウェアの作成を支援するフレームワーク 概要 Neuraxを利用することで、Golangバイナリは外部サーバーを使わずにLAN/WAN上で拡散できます。 多様な設定オプションとコマンドステージャにより、さまざまな無線環境で迅速な伝搬が可能です。 コード例 package main import . "github.com/redcode-labs/Neurax" func main //提供ポートとステージャの指定 Nrx.Config.Port = 5555 Nrx.Config.Stager = "wget" //バックグラウンドで現在のバイナリを公開するサーバーを起動 ...

markdown-exfil-tester

valtik-markdown-exfil-tester 用于 LLM 聊天机器人的黑盒测试工具，用于检测通过间接提示注入导致 Markdown / HTML 外泄 的漏洞。这一漏洞类别曾影响 Microsoft 365 Copilot（CVE-2025-32711，又名 EchoLeak）、ChatGPT（OpenAI 2026 年 2 月补丁）和 Salesforce（ForcedLeak）。模式如下： 1. 攻击者在 LLM 会读取的内容（文档、支持工单、PR、被摄入的网页、RAG 数据源）中植入 Markdown 或 HTML。 2. LLM 在响应中输出类似 的 Markdow...

CVE-2021-3560-Polkit-DBus

CVE-2021-3560-Polkit-DBus Script simple de prueba de concepto para la escalada de privilegios CVE-2021-3560 Polkit D-Bus. Para más información, consulta la publicación original del blog: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/ Uso Intenta ejecutar el...

CVE-2026-34621_PDF_SAMPLE

Technical Analysis of a Multi-Stage Adobe Acrobat PDF JavaScript Sample Overview This repository publishes a code-centric reverse-engineering write-up on a malicious PDF sample that embeds staged Adobe Acrobat JavaScript. The analyzed sample uses a hidden form field as its initial loader,...

CVE-2025-25198

CVE-2024-25198 mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an attacker-controll...