CVE-2026-123846: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation

In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation...

CVE-2026-123291: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs…

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook...

CVE-2026-123834: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's…

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account...

CVE-2026-122014

A flaw was found in npcpy. An input validation vulnerability in the model loading component allows a remote attacker to execute arbitrary code. By supplying a specially crafted model name or path parameter, an attacker can inject and execute unintended commands within the application's runtime...

buster

Description Buster is an advanced OSINT tool used to: Get social accounts of an email using multiple sourcesgravatar,about.me,myspace,skype,github,linkedin,previous breaches Get links to where the email was found using google,twitter,darksearch and paste sites Get breaches of an email Get domains...

Meterpreter_Paranoid_Mode-SSL

MeterpreterParanoidMode v1.4 - SSL/TLS connections Version release: v1.4 Stable Author: pedro ubuntu r00t-3xp10it Distros Supported : Linux Kali, Mint, Ubuntu Suspicious-Shell-Activity SSA RedTeam develop @2017 Description: MeterpreterParanoidMode.sh allows users to secure your staged/stageless...

CVE-2026-111494

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify...

CVE-2026-111494

The MatchPoint Android app by TPC Software is vulnerable to incorrect validation of TLS certificates . The root cause is a TrustManager that accepts any certificate combined with a permissive hostname validator. Furthermore, the application permits unencrypted HTTP traffic . These flaws allow an ...

xss_vulnerability_challenges

XSS Vulnerability Scenarios challenges This repository is a Dockerized php application containing some XSS vulnerability challenges. The ideas behind challenges are: Javascript validation bypass html entities bypass WAF bypass Black-list validation bypass Basic XSS validation bypass Double encode...

CVE-2026-111768

The Model Context Protocol TypeScript SDK is vulnerable to a memory exhaustion issue where a single HTTP request within the default 4 MiB limit can terminate the process due to JavaScript heap exhaustion . The root cause is the lack of enforced limits on the number of array elements and object ke...

chromium-browser: angle: chromium-browser: Improper input validation in ANGLE

An improper input validation flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=536450979...

chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page

A flaw was found in ANGLE, a graphics engine used in Google Chrome. This vulnerability, caused by improper validation of an array index, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation can occur when a user visits a specially crafted HTML...

c-CVE-2024-0044

CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...

CVE-2026-46350

The dcmjs JavaScript library (versions

CVE-2026-104135

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

cherrybomb

cherrybombv1.0.png Stop half-done API specifications 💣 What is Cherrybomb? Cherrybomb is an CLI tool written in Rust that helps prevent incorrect code implementation early in development. It works by validating and testing your API using an OpenAPI file. Its main goal is to reduce security errors...

CVE-2026-102476

A flaw was found in Eclipse Vert.x. This vulnerability can lead to information disclosure because the HTTP client improperly caches Secure Sockets Layer SSL contexts. When requesting a secure connection, a client may inadvertently reuse a cached context configured with weaker security properties,...

CVE-2026-116593

A flaw was found in Apache Kafka Connect. This vulnerability allows information disclosure when a remote attacker accesses the connector configuration validation endpoint. By submitting a request to this endpoint, an attacker can force installed configuration providers to resolve and return...

CVE-2026-112778

A flaw was found in Traefik. An authenticated attacker with permissions to create or update Kubernetes Ingress or Service resources can bypass multi-tenant isolation boundaries due to missing namespace validation in resource annotations. By referencing configuration objects in other namespaces, t...

CVE-2026-121392

A flaw was found in FreeRDP. A man-in-the-middle attacker possessing a certificate issued by a trusted Certificate Authority CA can exploit improper certificate identity validation during connection establishment. Because the client incorrectly accepts fallback certificate names and improperly...