CVE-2026-126316

The software Frappe HRMS versions 16.0.0 before 16.20.1 is affected by an information exposure vulnerability (CWE-598). The application places the subscription key in the query string of outbound subscription status requests. Consequently, attackers who can access proxy, server, or monitoring log...

EUVD-2026-125204

Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscriptio...

CVE-2026-126405

The Coder platform versions 2.21.0 before 2.29.24 , 2.30.0 before 2.34.16 , 2.35.0 before 2.36.11 , 2.37.0 before 2.37.8 , and 2.38.0 before 2.38.4 are vulnerable to a Memory Exhaustion Denial of Service (DoS) . The root cause is that the webpushSend function uses io.ReadAll to process Web Push e...

EUVD-2026-125160

Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST...

PowerLurk

PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

Gpt-Agreement-Payment

简体中文 | English Gpt-Agreement-Payment End-to-end replay tool for ChatGPT Plus / Team subscription agreements: reverse-engineered from packet capture the entire chain Stripe Checkout → PayPal / GoPay / QRIS → ChatGPT manual-approval → Codex OAuth + PKCE and implemented as a runnable client. Include...

RLSA-2026:97090 Important: subscription-manager-cockpit security update

Subscription Manager Cockpit UI Security Fixes: lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4800 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass CVE-2026-2950 For more details about the securi...

subscription-manager-cockpit security update

An update is available for subscription-manager-cockpit. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Subscription Manager Cockpit UI Security Fixes: lodash:...

RLSA-2026:97514 Important: subscription-manager-cockpit security update

Subscription Manager Cockpit UI Security Fixes: lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4800 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass CVE-2026-2950 For more details about the securi...

subscription-manager-cockpit security update

An update is available for subscription-manager-cockpit. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Subscription Manager Cockpit UI Security Fixes: lodash:...

SharpStay

SharpStay - .NET Persistence Building To compile open Visual Studio project and compile for release. Options Elevated Registry Keys Elevated UserInit Registry Key Elevated Scheduled Task Elevated Create Service Elevated WMI Event Subscription Non-Elevated InitMprLogonScript Registry Key...

madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access

madong-admin-saas = 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans. id: CVE-2026-120446 info: name: madong-admin-saas = 5.1.4 - Unauthenticated...

wnfexec

Overview WnfExec is a C proof of concept library that injects shellcode into a process by hijacking a WNF subscription callback then triggering a state change. There's nothing novel here and was built based on the research of others. My intent was to solidfy the concept in my head, document the...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

The Popup Builder WordPress plugin before 4.1.1 is vulnerable to SQL Injection and Reflected XSS via the sgpb-subscription-popup-id parameter. id: CVE-2022-0479 info: name: Popup Builder Plugin - SQL Injection and Cross-Site Scripting author: ritikchaddha severity: critical description: | The Pop...

CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation

🚨 CVE-2025-49706 – SharePoint Spoofing Vulnerability Under Active Exploitation By Aditya Bhatt – VAPT Specialist | Red Teamer 📌 TL;DR Microsoft SharePoint is under active threat. CVE‑2025‑49706, a spoofing vulnerability in SharePoint Server, has evolved from medium-severity to real-world...

candlepin: Consumer certificate can register systems in another organization

A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...

Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. Installation With...

OffensiveCSharp

OffensiveCSharp This is a collection of C tooling and POCs I've created for use on operations. Each project is designed to use no external libraries. Open each project's .SLN in Visual Studio and compile as "Release". Project| Description| Minimum .NET Version ---|---|--- AbandonedCOMKeys|...