Microsoft SharePoint - Web Services Discovery Detection

Detected exposed SharePoint web services via /vtibin/spdisco.aspx endpoint !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed SharePoint web services via /vtibin/spdisco.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

TIBCO Spotfire Statistics Services - Detect

TIBCO Spotfire Statistics Services was detected. !/usr/bin/env python3 -- coding: utf-8 -- """TIBCO Spotfire Statistics Services was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TIBCO Spotfire Statistics...

SOAP-based ASP.NET web services ASMX - Detect

SOAP-based ASP.NET web services collection was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SOAP-based ASP.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SOAP-based ASP.NET web services ASMX - Detect',...

WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting Detection

WordPress Car Repair Services & Auto Mechanic before 4.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the serviceestimatekey parameter before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Car Repair Services & Auto...

Cisco ISE Admin Login Panel - Detect

Cisco Identity Services Engine ISE admin login panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Identity Services Engine ISE admin login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

DataTaker DT80 dEX 1.50.012 - Information Disclosure Detection

DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/o...

CVE-2026-58343

A flaw was found in Moodle. Capability checks were missing from course assistance AI Artificial Intelligence placement web services. This could allow users to make requests to these web services without possessing the necessary permissions, potentially leading to unauthorized access to AI course...

RHSA-2026:46482 Red Hat Security Advisory: sssd security update

Bulletin has no description...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

igloohome Smart Lock Mobile Application

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure...

PT-2026-65591

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...

CVE-2026-16773: Exposure of Sensitive Information to an Unauthorized Actor

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...

Veeder-Root TLS4B Command Injection (CVE-2025-58428)

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...

CVE-2026-55391: Reliance on Reverse DNS Resolution for a Security-Critical Action

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action vulnerability

Unauthenticated Sensitive Information Exposure in 'wpbotsendemailtranscript' AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...

Malicious Package

Overview sme-crm-services-sme-crm-services-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious code in lab-services (npm)

Source: amazon-inspector 4acaa72e3c14b79785540c878cb48f7a0cdc238d20ac9cebd6ffdd42061f6e7b On npm install, the package's preinstall lifecycle script node.js collects host identifiers from the installing machine — hostname, public IP resolved via api.ipify.org, current working directory, OS platfor...

Malicious code in @equans-services/codex (npm)

Source: amazon-inspector 7d3c5a7e22ef9ecb88e2f6d85ef6132d80098e3e187cbc302de2c45140a5a5f1 This package typosquats @openai/codex under an unofficial scope and ships a postinstall hook package.json line 6: "postinstall": "node setup.js" that runs setup.js on install. setup.js performs a...

Malicious code in @azure-lab-services/ml-ts (npm)

--- Credit: OpenSSF source...

ADOKit v1.4.2

ADOKit Description Azure DevOps Services Attack Toolkit - ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials API key or stolen...