Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858
https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858
Cyera
Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
Cyera Research Labs has discovered a "worst-case scenario" flaw in n8n, the industry-leading platform for AI and workflow automation. Dubbed "Ni8mare," this vulnerability (CVE-2026-21858) allows an unauthenticated remote attacker to gain full administrative…
❤6
Please open Telegram to view this post
VIEW IN TELEGRAM
🤣17😁5❤3
The new RCE exploit is 100% effective; it has already generated 48 shells in just 10 minutes. ⚡
It involves 5 combined exploits affecting over 900,000 sites. 🎯
Affecting +970k websites
DM me to buy 👉 @Mm_fit
Channel: https://t.me/fox_security_cve
#AD
It involves 5 combined exploits affecting over 900,000 sites. 🎯
Affecting +970k websites
DM me to buy 👉 @Mm_fit
Channel: https://t.me/fox_security_cve
#AD
🤣9❤3🔥2🗿2
Did you know some exposed Google Maps API keys may also have access to Gemini models? 👀
Try geminiHunter to hunt for exposed Gemini API keys across:
* JS/source maps
* Wayback snapshots
* Android APKs
* Web assets
It also deduplicates and validates keys, helping you identify which exposed keys are actually usable.
🔗 https://github.com/devploit/geminiHunter
Please open Telegram to view this post
VIEW IN TELEGRAM
❤2
Please open Telegram to view this post
VIEW IN TELEGRAM
❤2
🚨 CVE-2026-87902 - WordPress Core - PHP Template Path Traversal
Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml
Reference: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
#hackwithautomation #bugbounty #wordpress
Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml
Reference: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
#hackwithautomation #bugbounty #wordpress
❤6🔥2
CVE-2026-88804: Unauthenticated update of public UI settings leading to stored XSS in Rancher, 9.4 Rating 🔥
An unauthenticated attacker can plant malicious content that runs in the browser of anyone visiting the Rancher login page. This can leak the local administrator bootstrap password or hijack an active admin session, leading to complete control of the Rancher installation and its managed downstream clusters.
Search at Netlas.io:
👉 Link: https://nt.ls/dtxM5
👉 Dork: http.favicon.hash_sha256:2d7adbc74e7c8941927d04e702acbff577d219fef8617c8c3014d34ae395525b OR http.body:"<title>Rancher</title>" OR http.unknown_headers.key:"x_api_cattle_auth"
Vendor's advisory:
https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f
An unauthenticated attacker can plant malicious content that runs in the browser of anyone visiting the Rancher login page. This can leak the local administrator bootstrap password or hijack an active admin session, leading to complete control of the Rancher installation and its managed downstream clusters.
Search at Netlas.io:
👉 Link: https://nt.ls/dtxM5
👉 Dork: http.favicon.hash_sha256:2d7adbc74e7c8941927d04e702acbff577d219fef8617c8c3014d34ae395525b OR http.body:"<title>Rancher</title>" OR http.unknown_headers.key:"x_api_cattle_auth"
Vendor's advisory:
https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f
❤7
/etc/passwd ==> WAF restriction? Use these:
/e?c/?asswd
/e*c/*asswd
/??c/?asswd
/??c/?assw?
Doesn't work always, just give it a try. 🎯
#bugbountytip #bugbountytips #bugbounty
/e?c/?asswd
/e*c/*asswd
/??c/?asswd
/??c/?assw?
Doesn't work always, just give it a try. 🎯
#bugbountytip #bugbountytips #bugbounty
❤20👎3
This media is not supported in your browser
VIEW IN TELEGRAM
#pentesting #redteam #bugbounty
Please open Telegram to view this post
VIEW IN TELEGRAM
❤6👍2
Please open Telegram to view this post
VIEW IN TELEGRAM
topmate.io
Bug Bounty Guide 2026 with Saumadip Mandal
Bug Bounty Guide 2026 with Saumadip Mandal · Master modern bug bounty hunting with 86 pages, 25 chapter · Digital Product · ₹199 · Topmate
❤2👍1
🚨Pentration Testing, Beginners To Expert!
https://github.com/xalgord/Massive-Web-Application-Penetration-Testing-Bug-Bounty-Notes#phase-2--web-and-server-technology
https://github.com/xalgord/Massive-Web-Application-Penetration-Testing-Bug-Bounty-Notes#phase-2--web-and-server-technology
❤10
A complete bug bounty workspace for HackerOne researchers. Includes scope enforcement, automated recon/vuln pipeline (400+ tools), report templates, CVE/CWE watchlists, and a local VM practice lab. Built for disciplined, ethical hunting.
https://github.com/DevCop95/bugbounty-lab101
https://github.com/DevCop95/bugbounty-lab101
GitHub
GitHub - DevCop95/bugbounty-lab101: A complete bug bounty workspace for HackerOne researchers. Includes scope enforcement, automated…
A complete bug bounty workspace for HackerOne researchers. Includes scope enforcement, automated recon/vuln pipeline (400+ tools), report templates, CVE/CWE watchlists, and a local VM practice lab....
❤8👍3🥰2
🚨 Critical pre-auth RCE in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771)
Critical Vulnerability Alert!
Citrix NetScaler ADC and NetScaler Gateway is affected by CVE-2026-88771.
🔍 Identify Targets via ZoomEye:
Search Dork: app="Citrix NetScaler"
Exposure: 239.2k instances identified globally.
ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXRyaXggTmV0U2NhbGVyIg%3D%3D
#Infosec #CyberSecurity #ZoomEye
Critical Vulnerability Alert!
Citrix NetScaler ADC and NetScaler Gateway is affected by CVE-2026-88771.
🔍 Identify Targets via ZoomEye:
Search Dork: app="Citrix NetScaler"
Exposure: 239.2k instances identified globally.
ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXRyaXggTmV0U2NhbGVyIg%3D%3D
#Infosec #CyberSecurity #ZoomEye
❤2
🚨APKLeaks - Scanning APK file for URIs, endpoints & secrets.
✅https://github.com/dwisiswant0/apkleaks
✅https://github.com/dwisiswant0/apkleaks
❤11
🚨 CVE-2026-102489: Zammad Unauthenticated Remote Code Execution Exploited Zero-Day
Critical Vulnerability Alert!
Zammad (Zammad GmbH) is affected by CVE-2026-102489.
🔍 Identify Targets via ZoomEye:
Search Dork: app="Zammad"
Exposure: 12k instances identified globally.
ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJaYW1tYWQi
#ZoomEye #CyberSecurity #Zammad #CVE2026102489 #RCE #ZeroDay
Critical Vulnerability Alert!
Zammad (Zammad GmbH) is affected by CVE-2026-102489.
🔍 Identify Targets via ZoomEye:
Search Dork: app="Zammad"
Exposure: 12k instances identified globally.
ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJaYW1tYWQi
#ZoomEye #CyberSecurity #Zammad #CVE2026102489 #RCE #ZeroDay
❤6