cve-exploit

CVE-EXPLOIT このソフトウェアは法的に正当な目的のみに 使用してください。 あなたの行動について、私は一切の責任を負いません。 Python 3.11.2 を使用してください。 制作: Edu0x01 説明 cve-exploit は CVE とエクスプロイトを見つけるためのハブです。公式の NIST、ExploitDB、GitHub のデータベースに基づいています。このツールを使用すると、CVE とそれに関連するエクスプロイトを迅速かつ簡単に検索できます。エクスプロイトのコンパイルオプションを検出することもできます。また、最新の重大な脆弱性を一覧表示するためにも使用できます。...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

CVE-2026-101041

The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...

CVE-2026-101041 Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...

EUVD-2026-87956

The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...

CVE-2026-101041

The vulnerability-lookup web application contains a TOCTOU race condition in its account recovery functionality (/user/confirm_account/). Specifically, the logic in the User model (website/models/user.py) and view layer (website/web/views/user.py) verifies and consumes single-use recovery tokens ...

CVE-2026-101041 Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...

CVE-2026-101041 Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...

PT-2026-99549

Name of the Vulnerable Software and Affected Versions vulnerability-lookup affected versions not specified Description The account recovery functionality contains a time-of-check-to-time-of-use TOCTOU race condition—a scenario where a system checks a condition and then uses the result, but the...

CVE-2026-101041: Concurrent Execution using Shared Resource with Improper Synchronization

The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...

CVE-2026-73431

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

CVE-2026-73374

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

CVE-2026-73405

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

CVE-2026-73432

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

EUVD-2026-57231

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432

CVE-2026-73432 affects Vulnerability-Lookup: SSRF via remote-instance synchronization where addresses were only validated for syntax before storage and later dereferenced with requests.get(), following redirects without network-boundary checks. An authenticated admin (admin:access) can configure ...

CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...