CVE-2026-75599

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. Wh...

CVE-2026-103112

A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset...

CVE-2026-97175

A vulnerability exists in the idp-auto-link authenticator of the keycloak-services component, which manages user identity federation. The root cause is that Keycloak automatically links incoming identities from external providers to existing local accounts based on matching email addresses withou...

CVE-2026-112208

The Keycloak authentication server is vulnerable to an account takeover via a flaw in the Organization identity-first login flow. The root cause is a failure to properly clear a success flag when a user is removed from a session after switching to a registration or password reset path. An attacke...

CVE-2026-103112

A flaw in the keycloak-services component of Keycloak allows for account takeover via an authentication race condition. The vulnerability arises because the system fails to verify if an authenticator remains valid when transitioning between the standard authentication path and the reset credentia...

CVE-2026-75599

The home inventory system HomeBox is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in versions prior to 0.27.0 . The root cause is the maybeUrl() utility, which fails to restrict URL schemes when processing markdown-style links in entity custom-field values . An authenticated attacker ca...

Subhunter

Subhunter A fast subdomain takeover tool Description: Subdomain takeover is a common vulnerability that allows an attacker to gain control over a subdomain of a target domain and redirect users intended for an organization's domain to a website that performs malicious activities, such as phishing...

Garud

An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters. I made this tool to automate my recon and save my time. It really give me headache always type such command and then wait to complete one command and I type oth...

can-i-take-over-xyz

Disclaimer ⚠️ The authors of this document take no responsibility for correctness. This project is merely here to help guide security researchers towards determining whether something is vulnerable or not, but does not guarantee accuracy. This project heavily relies on contributions from the...

CVE-2026-117691

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

Sublist3r

About Sublist3r Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting. Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing,...

PySQLRecon

PySQLRecon PySQLRecon is a Python port of the awesome SQLRecon project by @sanjivkawa. See the commands section for a list of capabilities. Post demonstrating SCCM TAKEOVER-1 with PySQLRecon. Install PySQLRecon can be installed with pip3 install pysqlrecon or by cloning this repository and runnin...

CVE-2026-109928

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to an incorrect authentication algorithm implementation in the password-reset and login JWT validation. An attacker who acquires a user's password-reset token (through methods such as email interception, log exposure, or ...

CVE-2026-117691

A vulnerability exists in the SAML HTTP-Redirect binding implementation of Keycloak . The root cause is a discrepancy where the server processes percent-encoded parameter names (such as %53AMLResponse), but the signature verification logic only validates literal parameter names. This allows an at...

CVE-2026-117691 Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

EUVD-2026-117441

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

CVE-2026-117691

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

NtHiM

NtHiM - Super Fast Sub-domain Takeover Detection Read the full NtHiM Documentation! This guide consists of documentations for users and developers using or contributing to NtHiM. Installation Method 1: Using Pre-compiled Binaries The pre-compiled binaries for different systems are available in th...

HostileSubBruteforcer

HostileSubBruteforcer This app will bruteforce for exisiting subdomains and provide the following information: IP address Host if the 3rd party host has been properly setup. for example if site.example.com is poiting to a nonexisiting Heroku subdomain, it'll alert you - Currently only works with...

Turbolist3r

Project Status Please note I am not actively supporting this project. I may return to subdomain research at some point but my security interests lie elsewhere at the moment and my time is divided among other things. If you find an issue feel free to send a PR or fork it into your own project...