GooFuzz

GooFuzz - The Power of Google Dorks Credits Author: M3n0sD0n4ld Twitter: @DavidUton Description: GooFuzz is a script written in Bash Scripting that uses advanced Google search techniques to obtain sensitive information in files or directories without making requests to the web server. What's new...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

HellRaiser

HellRaiser Vulnerability Scanner Install HellRaiser depends on cve-search API. Have a cve-search API running and add the address in config/config.yml on cvesearchapidomain field. Install ruby 2.7.2, bundler 1.17.3 and rails. https://gorails.com/setup/ubuntu/20.04 Install redis-server and nmap. su...

GitDorker

GitDorker GitDorker is a tool that utilizes the GitHub Search API and an extensive list of GitHub dorks that I've compiled from various sources to provide an overview of sensitive information stored on github given a search query. The Primary purpose of GitDorker is to provide the user with a cle...

CVE-2026-109958

EspoCRM version 4.0.0 before 10.0.7 is vulnerable to an improper access control vulnerability. Authenticated users with record access can bypass field-level restrictions to read restricted emailAddress values via the address-book search API . This occurs even when specific Roles are configured to...

freevulnsearch

freevulnsearch This NMAP NSE script is part of the Free OCSAF project - https://freecybersecurity.org. In conjunction with the version scan "-sV" in NMAP, the corresponding vulnerabilities are automatically assigned using CVE Common Vulnerabilities and Exposures and the severity of the...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

ChanCMS <= 3.3.0 - SQL Injection

yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the "key" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request. id: CVE-2025-10210 info: name: ChanCMS = 3.3.0 - SQL...

CVE-2026-102663

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath...

poc_monitor

pocmonitor A short scraper looking for a POC of CVE-2024-49112 Setting a cron job to run the script every 4 hours will keep the updates in place. The alerting can be customized but used Discord webhook to alert a Discord channel. 0 /4 cd /root/monitorscript && /usr/bin/python3 pocmonitor.py...

AZL-106724 CVE-2026-103006 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

CVE-2026-103006

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

CVE-2026-103006 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

CVE-2026-103006

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

CVE-2026-103006 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

EUVD-2026-93936

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

CVE-2026-103006

Elasticsearch is vulnerable to Uncontrolled Recursion (CWE-674) in its search aggregation processing . An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. This triggers unbounded recursive execution, exh...

Elasticsearch 9.0.x < 9.4.6 / 9.5.x < 9.5.2 DoS (ESA-2026-196)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-196 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially...

CVE-2026-103006: Uncontrolled Recursion

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

PT-2026-107165

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An uncontrolled recursion weakness exists in the search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containin...