ctftool

CTFTOOL ¿Solo quieres probar el exploit SYSTEM? Haz clic aquí. Una herramienta interactiva de exploración de CTF Esto es ctftool, una herramienta interactiva de línea de comandos para experimentar con CTF, un protocolo poco conocido utilizado en Windows para implementar servicios de texto. Esto...

mass-bruter

Mass Bruter Fuerza bruta masiva de protocolos de red Información POC simple para forzar rápidamente servicios comunes en una gran escala de red. Comprobará credenciales por defecto en ftp, ssh, mysql, mssql...etc. Esto fue creado únicamente con fines de pruebas de penetración autorizadas. Cómo...

dcipher

dcipher Descifra hashes utilizando servicios online de ataque de arcoíris y tablas de búsqueda. Instalación ❯❯❯ npm install dcipher Uso const dcipher = require'dcipher'; dcipher'21232f297a57a5a743894a0e4a801fc3'.thenplaintext = console.logplaintext; //= 'admin' ;...

beelzebub

Beelzebub Framework runtime di deception Beelzebub è un runtime di deception open-source che distribuisce servizi esca adattivi basati su LLM sui protocolli SSH, HTTP, TCP, TELNET e MCP. Va oltre i semplici honeypot passivi ingaggiando attivamente gli attaccanti in interazioni realistiche,...

PT-2026-110144

Name of the Vulnerable Software and Affected Versions Shepherd shepherd-ai versions prior to 0.3.2 Description A server-side request forgery guard bypass exists in the citation-checker extra. The issue occurs because the public url guard validates a resolved address, but the fetch function...

Apache Celix 2.4.0 EDEF XML Parser Heap Buffer Overflow

Apache Celix version 2.4.0 contains a heap-based buffer overflow in its remote-services Endpoint Description Extender XML parser. The supplied proof of concept generates a crafted endpoint descriptor that triggers the overflow. !/usr/bin/env python Apache Celix 2.4.0 EDEF XML Parser Heap-Based...

Apache Celix 2.4.0 EDEF XML Parser Heap-Based Buffer Overflow

Summary Apache Celix is an implementation of the OSGi specification adapted to C and C++. It is a framework to develop dynamic modular software applications using component and/or service-oriented programming. Description Apache Celix suffers from a heap-based buffer overflow vulnerability in its...

CVE-2026-108602

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

EUVD-2026-96428

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...

CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...

CVE-2026-108115

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

CVE-2026-108115

Kortix Suna versions 0.10.7 before 0.13.52 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause is a bypass of the isPrivateIp guard, which can be circumvented by using IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers possessing the project.conn...

PT-2026-109668

Name of the Vulnerable Software and Affected Versions PDFMathTranslate pdf2zh versions prior to 1.9.12 Description An unauthenticated attacker can perform a server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended location. The issue exists...

CVE-2026-108602: Server-Side Request Forgery (SSRF)

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108115: Server-Side Request Forgery (SSRF)

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...