CVE-2026-109082

A flaw in the keycloak-services component of Keycloak affects the Client-Initiated Backchannel Authentication (CIBA) implementation. The root cause is a failure to verify that a client is authorized to use the CIBA flow, which allows public clients to bypass security requirements. An attacker cou...

CVE-2026-109082 Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

CVE-2026-109082

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

PT-2026-110484

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component. This component manages authentication flows where a client...

PT-2026-110645

🚨 CVE-2026-85952 Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized acces...

PT-2026-110587

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions prior to 9.4 Description Authenticated users can access and modify unauthorized documents due to missing authorization in SoapDocumentService operations. By using sequential document IDs via SOAP or the...

CVE-2026-109082: Improper Authentication

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

Active Directory Domain Services Code Execution

The vulnerability of the Active Directory Domain Services service on the Windows operating system is related to the lack of measures taken at the management level to protect data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-85952: Server-Side Request Forgery (SSRF)

Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud...

VulnCheck KEV: CVE-2026-42596

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as...

restler-fuzzer

RESTler ¿Qué es RESTler? RESTler es la primera herramienta de fuzzing de API REST con estado para probar automáticamente servicios en la nube a través de sus API REST y encontrar errores de seguridad y confiabilidad en estos servicios. Para un servicio en la nube dado con una especificación OpenA...

onionscan

¿Qué es OnionScan? OnionScan es una herramienta gratuita y de código abierto para investigar la Dark Web. A pesar de todas las increíbles innovaciones tecnológicas en el ámbito del anonimato y la privacidad, siempre existe una amenaza constante que no tiene un parche tecnológico efectivo: el erro...

awesome-privacy

A curated list of privacy-respecting apps, software, and providers 🌐 awesome-privacy.xyz CodeBerg Mirror | Submit an Addition | Raw data & API Intro Large data-hungry corporations dominate the digital world but with little, or no respect for your privacy. Migrating to open-source applications wit...

drs-malware-scan

Análisis de escaneo de malware en servidores on-premises utilizando servicios de AWS Desafíos de la detección de malware en entornos on-premises Para los equipos de seguridad, puede ser difícil monitorear continuamente todos los servidores on-premises debido a restricciones presupuestarias y de...

CVE-2026-108741

The Shepherd (shepherd-ai) software, version 0.3.1 and below, is vulnerable to a Server-Side Request Forgery (SSRF) via DNS Rebinding in the citation-checker extra. The root cause is a Time-of-check Time-of-use (TOCTOU) race condition where the public_url guard validates a resolved address, but t...

CVE-2026-108741

Shepherd shepherd-ai through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the publicurl guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and...

EUVD-2026-96907

Shepherd shepherd-ai through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the publicurl guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and...

gattacker

Un paquete Node.js para Man-in-the-Middle en BLE Bluetooth Low Energy y más. Prerrequisitos ver: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno Instalación npm install gattacker Uso Configurar Al ejecutar ambos componentes, configure las variables en config.env:...

ctftool

CTFTOOL ¿Solo quieres probar el exploit SYSTEM? Haz clic aquí. Una herramienta interactiva de exploración de CTF Esto es ctftool, una herramienta interactiva de línea de comandos para experimentar con CTF, un protocolo poco conocido utilizado en Windows para implementar servicios de texto. Esto...

mass-bruter

Mass Bruter Fuerza bruta masiva de protocolos de red Información POC simple para forzar rápidamente servicios comunes en una gran escala de red. Comprobará credenciales por defecto en ftp, ssh, mysql, mssql...etc. Esto fue creado únicamente con fines de pruebas de penetración autorizadas. Cómo...