CVE-2026-21850 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...

CVE-2026-35107 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface UserMenu component. The redirect to the login page on logout used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect destination. This may be used in phishing...

CVE-2026-35104 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the user registration page Signup component. The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. Thi...

CVE-2026-35109 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached responses may be retrieved by an unauthorized user with access to the cache, potentially resulting in unintended behavior or security impac...

CVE-2026-35109 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached responses may be retrieved by an unauthorized user with access to the cache, potentially resulting in unintended behavior or security impac...

Exploit for CVE-2026-100109

CVE-2026-100109 — Security For WooCommerce unauthenticated adm...

Exploit for CVE-2026-114630

CVE-2026-114630 — ELEX HelpDesk unauthenticated arbitrary file...

ike-scan

ike-scan Discover and fingerprint IKE hosts IPsec VPN Servers Table of Contents Building and Installing Overview Usage Implementation Details Host Input and Memory Requirements Rate Limiting Cookie Generation and Remote Host Identification IKE Packet Details Backoff Fingerprinting Program Output...

Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

Hikvision IP Camera: Authentication Bypass CVE-2017-7921...

CVE-2026-123746

The Symfony Security HTTP component AuthenticatorManager::authenticateUser does not run the firewall user checker’s checkPostAuth method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony...

Remote-BOF-Runner

Remote BOF Runner A Havoc extension framework for remote execution of Beacon Object Files BOFs using a PIC loader made with Crystal Palace. Overview Remote BOF Runner enables secure execution of BOFs in arbitrary processes by leveraging the Crystal Palace PIC loader. This framework implements a...

NimPlant

NimPlant - A light first-stage C2 implant written in Nim|Rust and Python By Cas van Cooten @chvancooten, with special thanks to some awesome folks: Kadir Yamamoto @yamakadi, Furkan Göksel @frkngksl , Fabian Mosch @S3cur3Th1sSh1t, Rafael Félix @b1scoito, Guillaume Caillé @OffenseTeacher, and many...

UnhookMe

UnhookMe - Dynamically unhooking imports resolver In the era of intrusive AVs and EDRs that introduce hot-patches to the running processes for their enhanced optics requirements, modern adversaries must have a robust tool to slide through these watchguards. The propsed implementation of dynamic...

Nettacker

OWASP Nettacker DISCLAIMER THIS SOFTWARE WAS CREATED FOR AUTOMATED PENETRATION TESTING AND INFORMATION GATHERING. YOU MUST USE THIS SOFTWARE IN A RESPONSIBLE AND ETHICAL MANNER. DO NOT TARGET SYSTEMS OR APPLICATIONS WITHOUT OBTAINING PERMISSIONS OR CONSENT FROM THE SYSTEM OWNERS OR ADMINISTRATORS...

LinkedInDumper

LinkedInDumper Python 3 script to dump company employees from LinkedIn API 💬 Description LinkedInDumper is a Python 3 script that dumps employee data from the LinkedIn social networking platform. The results contain firstname, lastname, position title, location and a user's profile link. Only 2 A...

progress-burp

Progress Tracker Burp Suite extension to track vulnerability assessment progress. Features Capturing items unique requests from the Burp Suite tools Proxy, Repeater, Target. Request unique key is defined as follows: target host, port, protocol, path and method. Items have following editable...

riscv-isa-sim

Spike RISC-V ISA Simulator About Spike, the RISC-V ISA Simulator, implements a functional model of one or more RISC-V harts. It is named after the golden spike used to celebrate the completion of the US transcontinental railway. Spike supports the following RISC-V ISA features: RV32I and RV64I ba...

cervantes

Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients, vulnerabilities, and reports in a single, centralized location. By facilitating efficient data...

ALHacking

Author: 4lbH4cker Version 4 Hacking Tools Tools to help you with ethical hacking, Social media hack, phone info, Gmail attack, phone number attack, user discovery, Webcam Hack • Powerful DDOS attack tool!! Youtube Video: https://www.youtube.com/watch?v=zgdq6ErscqY Operating System Requirements...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...