Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

Summary isPublicIP in core/providers/utils/fetch.go — the SSRF deny-list that gates FetchAndEncodeURL — does not reject several routable address ranges that map onto internal infrastructure. Carrier-Grade NAT 100.64.0.0/10, RFC 6598, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and...

twitter-advanced-search

🔍 Erweiterte Suche auf Twitter Diese Operatoren funktionieren im Web, auf Mobil, in Tweetdeck. Es gibt einige Überschneidungen, aber größtenteils funktionieren sie nicht für die v1.1 Search, Premium Search oder v2 Search APIs. Adaptiert von der TweetDeck Hilfe, @lucahammer Anleitung, @eevee Twitt...

http-request-smuggling

HTTP Request Smuggling Detection Tool HTTP request smuggling is a high severity vulnerability which is a technique where an attacker smuggles an ambiguous HTTP request to bypass security controls and gain unauthorized access to performs malicious activities, the vulnerability was discovered back ...

go-without-bounds-cve-2026-67822-stack-overflow-in-tenda-w6-s-wifissidset

CVE-2026-67822 — Tenda W6-S wifiSSIDset-Stack-Pufferüberlauf PoC Begleit-PoC zum Hunt-Benito-Artikel "GO Without Bounds: CVE-2026-67822 — Stack-Pufferüberlauf imwifiSSIDset-Formularhandler des Tenda W6-S". CVE-2026-67822 CVSS 9.8 Kritisch, CWE-121 ist ein stack-basierter Pufferüberlauf in...

CVE-2026-64640

CVE-2026-64640 — Apache Polaris: register में लोकेशन सत्यापन से पहले क्रेडेंशियल वितरण CVE-2026-64640 के लिए एक स्व-निहित, एक-कमांड रीप्रोड्यूसर: Apache Polaris में Iceberg REST register एंडपॉइंट, कॉलर द्वारा दिए गए पाथ के लिए क्लाउड स्टोरेज क्रेडेंशियल जारी करते हैं और उस पाथ को कैटलॉग की...

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update

Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...

EUVD-2026-42984

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Babel (@babel/helpers) (CVE-2025-27789)

Summary A ReDoS and performance degradation vulnerability in Babel CVE-2025-27789 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading @babel/helpers to versions 7.27.4 and 7.29.2. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next...

CVE-2026-63030

wp2shell — वर्डप्रेस कोर प्री-ऑथ RCE CVE-2026-63030 बैच रूट कन्फ्यूज़न + CVE-2026-60137 SQL इंजेक्शन बिना किसी डिपेंडेंसी वाला शोषण टूलकिट, WordPress Core में wp2shell कमज़ोरियों की श्रृंखला के लिए। एक अकेला अनाम HTTP अनुरोध, बिना किसी प्लगइन की आवश्यकता के, एक डिफ़ॉल्ट WordPress इंस्टॉलेशन पर...

krie

KRIe KRIe ist ein Forschungsprojekt, das darauf abzielt, Linux-Kernel-Exploits mit eBPF zu erkennen. KRIe ist weit davon entfernt, eine wasserdichte Strategie zu sein: Von eBPF-bedingten Einschränkungen bis hin zu Post-Exploitation-Erkennungen, die möglicherweise auf einen kompromittierten Kernel...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell قراءة ملفات تعسفية عبر Rails Active Storage/libvips → سرقة SECRETKEYBASE → تنفيذ تعليمات برمجية عن بُعد نظرة عامة CVE-2026-66066 عبارة عن سلسلة هجوم بخطورة حرجة CVSS 9.5 تبدأ بقراءة ملف تعسفي قبل المصادقة وتنتهي بتنفيذ تعليمات برمجية عن بُعد في وحدة Active Storag...

CVE-2026-21011-Log4j-style-JNDI-Injection-in-Custom-Logger-Simulated-

CVE-2026-21011 – कस्टम लॉगर में Log4j‑शैली JNDI इंजेक्शन सिम्युलेटेड प्रोग्राम कोड Python में Java सिमुलेशन root@kitploit: log4jsim.py - Custom logger that evaluates $... patterns import subprocess, re def logmessage: Vulnerable: looks up JNDI-like syntax and executes pattern = r'$\jndi:.+?' for...

CVE-2026-21003-JWT-none-Algorithm-Bypass-via-kid-Header-Omission

CVE-2026-21003 – Bypass do Algoritmo "none" do JWT via Omissão do Cabeçalho kid Código do Programa Node.js root@kitploit: // jwtverifyserver.js - Vulnerable JWT verification const jwt = require'jsonwebtoken'; const express = require'express'; const app = express; app.useexpress.json; const...

BinGoo

,--="=--, / ." .-. "./ / ,/ : : /\ \ | /o\ :: /o\ | / -'| :=" "=: | \ / .-"-. \ | / .-"-. .--- --| /,.-'-.,\ |-- ---. /-===- / | / | | | | | | ' | | / \ / | | | | | | | | | | | | | || |/| || | || / / '-----v1--------------By-Hood3dRob1n----' Bem-vindo ao arquivo README do BinGoo! Isso deve dar um...

CVE-2026-1111-Smart-Contract-Cross-Function-Reentrancy

CVE-2026-1111 – Reentrancy tra funzioni in Smart Contract Codice del programma Solidity + Python root@kitploit: // VulnerableBank.sol - Simplified reentrancy example with cross-function bypass pragma solidity ^0.8.0; contract VulnerableBank mappingaddress = uint256 public balances; function depos...

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Summary Yamcs compiles StreamSQL query expressions to Java at runtime with Janino. The LIKE operator inserts the user-supplied pattern into the generated Java unescaped, inside a "..." literal, so a pattern containing " breaks out and injects arbitrary Java e.g. a static block that runs an OS...

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Summary templateArgs sent to POST /api/instances and PATCH /api/instances/instance are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each services: entry by its class:, so injecting YAML through a template arg lets you add a services:...

GHSA-73MF-M39P-WPM9 Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Summary templateArgs sent to POST /api/instances and PATCH /api/instances/instance are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each services: entry by its class:, so injecting YAML through a template arg lets you add a services:...

scripts-nse

Cos'è? Alcuni script NSE per cercare informazioni dai router. L'autore di questi script è VicenDominguez. Ha trovato il 0-Day su Huawei, io l'ho solo modificato per altri due. L'autore di questo script non è responsabile del suo utilizzo. Huawei HG253s v2 Vodafone-Spagna sta iniziando a fornire i...

Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Summary Missing authorization checks on three IAM API endpoints GET /api/roles, GET /api/roles/name, GET /api/privileges allow any authenticated user — regardless of their assigned permissions — to enumerate the complete list of system privileges and role definitions. An attacker with only a...