cve-2024-34351-demo

CVE-2024-34351 डेमो CVE-2024-34351 प्रदर्शित करने के लिए न्यूनतम Next.js 14.0.0 एप्लिकेशन - Next.js सर्वर एक्शन में एक सर्वर-साइड रिक्वेस्ट फॉरजरी SSRF कमजोरी। Adam Kues और Shubham Shah द्वारा Assetnote पर खोजा गया। Next.js 14.1.1 में ठीक किया गया। असुरक्षा कैसे काम करती है जब कोई सर्वर एक्शन...

PSPKIAudit

PSPKIAudit PowerShell-Toolkit zur Überwachung von Active Directory Certificate Services AD CS. Es basiert auf dem PKISolution PSPKI-Toolkit Microsoft Public License. Dieses Repository enthält eine neuere Version von PSPKI als die in der PSGallery verfügbare siehe das PSPKI-Verzeichnis. Vadims...

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard the privacy of users' home networks. Topping the list is support for Encrypted Client Hello ECH, a privacy standard that prevents networks fro...

CVE-2026-82324

A flaw was found in the file-iff IFF/ILBM plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes nPlanes is zero. This causes a row size mismatch that bypasses...

CVE-2026-5096

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-65694-PoC

CVE-2026-65694 — Leitura Arbitrária de Arquivos Não Autenticada no Microweber CMS Prova de conceito para CVE-2026-65694 , uma leitura arbitrária de arquivos por path-traversal não autenticado no Microweber CMS. Um atacante não autenticado pode ler qualquer arquivo que o usuário do servidor web...

BIT-TOMCAT-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0...

GHSA-JW39-3688-R4RX Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

misp-dashboard

misp-dashboard Una dashboard che mostra dati in tempo reale e statistiche dai feed ZMQ di una o più istanze MISP. La dashboard può essere utilizzata come strumento di situational awareness in tempo reale per raccogliere informazioni sulle minacce. misp-dashboard include uno strumento di...

wp2shell

wp2shell Sfrutta la route confusion dell'API REST di WordPress CVE-2026-63030 + l'SQL injection CVE-2026-60137 nell'endpoint batch per ottenere l'esecuzione remota di codice. Vulnerabilità Route Confusion CVE-2026-63030 L'endpoint batch /batch/v1 dell'API REST di WordPress non isola correttamente...

slipstream

NAT Slipstreaming NAT Slipstreaming permette a un attaccante di accedere da remoto a qualsiasi servizio TCP/UDP associato a qualsiasi sistema dietro il NAT della vittima, bypassando il NAT/firewall della vittima controllo remoto arbitrario dei fori del firewall, semplicemente visitando un sito we...

GHSA-8X7X-83CF-C3PG Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Summary A cross-tenant write / DoS vulnerability in the Hatchet Dispatcher gRPC service allows any holder of a normal tenant-scoped API token the lowest credential Hatchet issues — an OWNER of a brand-new tenant to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UU...

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Summary A cross-tenant write / DoS vulnerability in the Hatchet Dispatcher gRPC service allows any holder of a normal tenant-scoped API token the lowest credential Hatchet issues — an OWNER of a brand-new tenant to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UU...

Exploit for Path Traversal in Jfrog Artifactory

cve-id Donate Help maintain this project...

CVE-2025-50364_CSRF_ADD_CATEGORY-phpgurukul-CVE

Nome do Projeto e URL do Repositório: Sistema de Gestão de Contratação de Empregadas Domésticas usando PHP e MySQL Tipo de Vulnerabilidade: Client Side Request Forgery Versãoões Afetadas: v1.0 💣Descrição da Vulnerabilidade: Existe uma vulnerabilidade de Cross-Site Request Forgery CSRF no painel d...

meg

meg meg é uma ferramenta para buscar muitas URLs, mas ainda sendo 'educada' com os servidores. Pode ser usada para buscar muitos caminhos para muitos hosts; buscando um caminho para todos os hosts antes de passar para o próximo caminho e repetir. Você obtém muitos resultados rapidamente, mas nenh...

GHSA-8JQH-95G6-7JPJ Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Summary Phalcon\Encryption\Crypt provides authenticated encryption: when useSigning is enabled the default, encrypt appends an HMAC tag and decrypt verifies it before returning the plaintext. The verification compares the attacker-supplied tag against the freshly computed HMAC using PHP/Zephir...