// vulnerability spotlight
FixVibe जो हर जाँच चलाता है,
explained.
FixVibe के साथ 164+ vulnerability classes आती हैं। हर entry प्रति scan 35 तक sub-checks चलाती है और समझाती है कि बग कैसे काम करता है, हमलावर को क्या मिलता है, हम इसे कैसे test करते हैं, और बचाव के लिए क्या चाहिए।
01 / 07
HTTP और Surface
Session Cookie Attributes
HttpOnly, Secure, SameSite — three flags that turn a session cookie into something attackers can't easily steal.
spotlight पढ़ें →
HTTP Security Headers
Headers are free defense — most apps still ship without them.
spotlight पढ़ें →
TLS Configuration
Old cipher suites plus missing HSTS equals a hostile WiFi away from session hijack.
spotlight पढ़ें →
Vercel Deployment Protection
Generated deployment URLs should not become public staging doors.
spotlight पढ़ें →
02 / 07
Secrets
Hard-coded Secret Patterns
Stripe keys, AWS credentials, OpenAI tokens — pattern matching catches the easy mistakes.
spotlight पढ़ें →
Secrets in JavaScript Bundles
If it shipped in your client bundle, it's not a secret — it's a publication.
spotlight पढ़ें →
JWT Integrity (alg confusion, weak secrets)
If your JWT verifier trusts the token's own header, it will believe whatever the attacker types.
spotlight पढ़ें →
Tokens in Browser Storage
localStorage is JavaScript-readable. Auth tokens stored there are XSS-stealable by design.
spotlight पढ़ें →
Exposed Source Maps
If your .map files are public, the attacker is reading your TypeScript.
spotlight पढ़ें →
Information Leakage in JavaScript
Internal API hosts, version banners, and TODO comments — small leaks add up to a map of your stack.
spotlight पढ़ें →
03 / 07
Backend-as-a-Service
Firebase Security Rules
`allow read, write: if true` is somebody's production database right now.
spotlight पढ़ें →
Supabase Row-Level Security
Without RLS on every public table, your anon key is a license to read anything.
spotlight पढ़ें →
Clerk & Auth0 Configuration
Identity providers leak more than they should when defaults aren't tightened.
spotlight पढ़ें →
Supabase Storage and API Posture
Public buckets and anon-listable objects are where BaaS data leaks start.
spotlight पढ़ें →
04 / 07
DNS
Netmaker DNS Key Authorization Bypass
A VPN control-plane DNS API should not trust a legacy default key.
spotlight पढ़ें →
Subdomain Takeover
A CNAME pointing at an unclaimed cloud resource is an invitation to host phishing on your domain.
spotlight पढ़ें →
SPF / DKIM / DMARC
Without these three records, anyone can send email as you.
spotlight पढ़ें →
05 / 07
Discovery
Arcserve UDP Heap Overflow Advisory
Backup management consoles should not expose affected UDP versions.
spotlight पढ़ें →
Schneider Modicon M221 Firmware Advisory
PLC firmware evidence should drive patch and segmentation review, not reboot or authentication replay tests.
spotlight पढ़ें →
CVE Cross-Reference
Detected version + public CVE database = a list of attacks already documented.
spotlight पढ़ें →
Debug & Admin Endpoints
/debug, /admin, /server-status — paths that should never be reachable from the internet.
spotlight पढ़ें →
Exposed Files & Backup Directories
.env, .git, .DS_Store, backup.sql — files that should never be public, accidentally are.
spotlight पढ़ें →
Rockwell MicroLogix 1100 DoS Advisory
An exposed PLC fingerprint is an operations risk, not something to crash-test.
spotlight पढ़ें →
SPIP Template RCE Version Exposure
Public SPIP version banners can reveal an RCE-class patch gap.
spotlight पढ़ें →
Checking Apache ActiveMQ Artemis for CVE-2023-50780
Checking Apache ActiveMQ Artemis for CVE-2023-50780
spotlight पढ़ें →
Checking Apache Airflow for CVE-2024-45498
Checking Apache Airflow for CVE-2024-45498
spotlight पढ़ें →
Checking Apache Tomcat for CVE-2020-11996
Checking Apache Tomcat for CVE-2020-11996
spotlight पढ़ें →
Checking Claude Code GitHub Action workflow permissions
Checking Claude Code GitHub Action workflow permissions
spotlight पढ़ें →
Checking codexui-android for token-stealing package versions
Checking codexui-android for token-stealing package versions
spotlight पढ़ें →
Checking cordova-plugin-inappbrowser for CVE-2019-0219
Checking cordova-plugin-inappbrowser for CVE-2019-0219
spotlight पढ़ें →
Checking DICOM files for executable preambles
Checking DICOM files for executable preambles
spotlight पढ़ें →
Checking Django for CVE-2011-0696
Checking Django for CVE-2011-0696
spotlight पढ़ें →
Checking Drupal Core for CVE-2026-9082
Checking Drupal Core for CVE-2026-9082
spotlight पढ़ें →
Checking easy-day-js for Mastra npm incident package evidence
Checking easy-day-js for Mastra npm incident package evidence
spotlight पढ़ें →
Checking Keras for CVE-2025-1550
Checking Keras for CVE-2025-1550
spotlight पढ़ें →
Checking Langflow CORS exposure for CVE-2025-34291
Checking Langflow CORS exposure for CVE-2025-34291
spotlight पढ़ें →
Checking Log4j 1.2 JDBCAppender for CVE-2022-23305
Checking Log4j 1.2 JDBCAppender for CVE-2022-23305
spotlight पढ़ें →
Checking MindsDB version exposure for CVE-2026-27483
Checking MindsDB version exposure for CVE-2026-27483
spotlight पढ़ें →
Checking MISP STIX import source for CVE-2018-19908
Checking MISP STIX import source for CVE-2018-19908
spotlight पढ़ें →
Checking Moby/Docker Go modules for CVE-2026-34040
Checking Moby/Docker Go modules for CVE-2026-34040
spotlight पढ़ें →
Checking NGINX rewrite configurations for CVE-2026-42945
Checking NGINX rewrite configurations for CVE-2026-42945
spotlight पढ़ें →
Checking NiceGUI upload source for CVE-2026-25732
Checking NiceGUI upload source for CVE-2026-25732
spotlight पढ़ें →
Checking Nokogiri for CVE-2019-18197
Checking Nokogiri for CVE-2019-18197
spotlight पढ़ें →
Checking npm lockfiles for known typosquat package versions
Checking npm lockfiles for known typosquat package versions
spotlight पढ़ें →
Checking ONNX for CVE-2024-5187
Checking ONNX for CVE-2024-5187
spotlight पढ़ें →
Checking Paramiko for CVE-2018-7750
Checking Paramiko for CVE-2018-7750
spotlight पढ़ें →
Checking proxy npm package for CVE-2023-2968
Checking proxy npm package for CVE-2023-2968
spotlight पढ़ें →
Checking Spring Data Commons and XMLBeam for CVE-2018-1259
Checking Spring Data Commons and XMLBeam for CVE-2018-1259
spotlight पढ़ें →
Checking SQLitePCLRaw native SQLite packages for CVE-2025-6965
Checking SQLitePCLRaw native SQLite packages for CVE-2025-6965
spotlight पढ़ें →
Checking vLLM for CVE-2024-9053
Checking vLLM for CVE-2024-9053
spotlight पढ़ें →
Checking WordPress REST API user exposure
Checking WordPress REST API user exposure
spotlight पढ़ें →
Checking YOURLS for CVE-2019-14537
Checking YOURLS for CVE-2019-14537
spotlight पढ़ें →
Cloudflare Origin & Proxy Posture
If your origin IP is discoverable, Cloudflare's WAF is bypassable.
spotlight पढ़ें →
GraphQL Introspection Exposed
Introspection in production hands the attacker your full type system.
spotlight पढ़ें →
Threat-Intel Cross-Reference
Spamhaus DBL, URLhaus — your domain's reputation, externally seen.
spotlight पढ़ें →
Exposed API Documentation
/swagger.json, /openapi.json, /docs — public API maps for both you and the attacker.
spotlight पढ़ें →
Netlify-Specific Exposure
Netlify deploy preview URLs, x-nf-* headers, _redirects mistakes.
spotlight पढ़ें →
Privacy & Cookie Compliance Markers
GDPR-required pages — present and linked, or you're at risk of a complaint.
spotlight पढ़ें →
Technology Fingerprinting
Knowing your stack is half the recon — outdated frameworks turn that into the other half.
spotlight पढ़ें →
Vercel-Specific Exposure
_next/static, x-vercel-* headers, preview URLs — Vercel-isms that leak more than they should.
spotlight पढ़ें →
06 / 07
सक्रिय probes
AVideo Command Injection Advisory
An outdated AVideo Composer dependency can expose video-link import paths to command execution risk.
spotlight पढ़ें →
Cross-Tenant Data Leaks
Multi-tenant SaaS without tenant ID enforcement leaks customer data across orgs.
spotlight पढ़ें →
GeniXCMS Author SQL Injection Exposure
A legacy CMS author filter should not turn one parameter into SQL syntax.
spotlight पढ़ें →
JWT alg=none Acceptance
A decoded token is not an authenticated identity.
spotlight पढ़ें →
MagicMirror /cors SSRF Exposure
A smart-mirror helper endpoint should not become a network proxy.
spotlight पढ़ें →
Moxa NPort Firmware Advisory
A public device-server firmware banner should drive an upgrade, not a crash test.
spotlight पढ़ें →
OS Command Injection
When user input becomes part of a shell command, the shell runs whatever the attacker writes.
spotlight पढ़ें →
rclone RC Authentication Exposure
A public rclone Remote Control API should not answer unauthenticated fsinfo requests.
spotlight पढ़ें →
Server-Side Template Injection (SSTI)
When a template engine treats user input as a template, the server treats user input as code.
spotlight पढ़ें →
SiteOmat BOS Authentication Advisory
Fuel-station management software needs version and exposure review, not password guessing.
spotlight पढ़ें →
SiteOmat CGI Buffer Overflow Advisory
Fuel-station controller CGI risk needs patch and exposure review, not exploit probes.
spotlight पढ़ें →
SiteOmat Login SQL Injection Advisory
Fuel-station login risk needs patch and exposure review, not authentication-bypass probes.
spotlight पढ़ें →
SQL Injection
When user input becomes part of a query, the database stops being yours.
spotlight पढ़ें →
Auth Flow Defects
Login, signup, and password reset are where most account takeovers actually happen.
spotlight पढ़ें →
Blind SSRF (Out-of-Band)
If the server fetches user-supplied URLs, the user can make it fetch internal services.
spotlight पढ़ें →
CKAN DataStore SQL Authorization Bypass
Public DataStore SQL access can turn open data APIs into private data exposure.
spotlight पढ़ें →
CORS Misconfiguration
Permissive Access-Control-Allow-Origin plus credentials means your API is everyone's API.
spotlight पढ़ें →
DOM-based XSS via URL Fragment
Modern SPAs read location.hash and write it into the DOM — attacker payloads ride along.
spotlight पढ़ें →
File Upload Validation
User-uploaded files are arbitrary bytes — accepting them as 'images' without checking is asking for RCE.
spotlight पढ़ें →
FUXA Hardcoded JWT Fallback Secret
Default token-signing secrets can turn an HMI login into a weak boundary.
spotlight पढ़ें →
GL.iNet GL-MT3000 Firmware Advisory
A router firmware match should drive an upgrade, not a command-execution test.
spotlight पढ़ें →
GraphQL Depth Bombing & Batch Bypass
GraphQL's flexibility is also its vulnerability — depth bombs, alias batching, and field-suggestion leaks.
spotlight पढ़ें →
HTTP Request Smuggling
Front-end proxy and back-end disagree on where one request ends — attacker rides the seam.
spotlight पढ़ें →
IDOR / BOLA
If your API trusts the client to send the correct ID, the client can send any ID.
spotlight पढ़ें →
IIS TRACK Method Information Disclosure
Legacy HTTP method echo behavior should be disabled before it can expose request headers.
spotlight पढ़ें →
Liferay Portal Template RCE Advisory
Legacy Liferay Portal version evidence should trigger patch verification.
spotlight पढ़ें →
LLM Prompt Injection
If your AI feature trusts user input as instruction, the user can rewrite the system prompt.
spotlight पढ़ें →
NoSQL Operator Injection
MongoDB-style operators in user-controlled JSON turn your query into a wildcard.
spotlight पढ़ें →
Reflected Cross-Site Scripting (XSS)
The silent hijack: when a single unsanitized parameter executes attacker code in your users' browsers.
spotlight पढ़ें →
Rockwell MicroLogix 1100 Authentication Advisory
Firmware evidence should drive an update and exposure review, not password-guessing tests.
spotlight पढ़ें →
XML External Entity (XXE)
If your XML parser resolves external entities, your server reads files for the attacker.
spotlight पढ़ें →
ZoneMinder Directory Listing Exposure
A camera management UI should not publish its web root index.
spotlight पढ़ें →
Account Enumeration
If your login responds differently when the email exists vs doesn't, attackers can build a customer list.
spotlight पढ़ें →
Checking gemini-mcp-tool for CVE-2026-0755
Checking gemini-mcp-tool for CVE-2026-0755
spotlight पढ़ें →
Checking Label Studio upload-example XSS exposure
Checking Label Studio upload-example XSS exposure
spotlight पढ़ें →
Checking Langflow version exposure for CVE-2026-33017
Checking Langflow version exposure for CVE-2026-33017
spotlight पढ़ें →
Checking PowerLogic EGX exposure for CVE-2021-22765/CVE-2021-22767/CVE-2021-22768
Checking PowerLogic EGX exposure for CVE-2021-22765/CVE-2021-22767/CVE-2021-22768
spotlight पढ़ें →
Checking TLS endpoints for RC4 support
Checking TLS endpoints for RC4 support
spotlight पढ़ें →
Checking TLS endpoints for Sweet32 DES/3DES support
Checking TLS endpoints for Sweet32 DES/3DES support
spotlight पढ़ें →
Confirming Glances REST API unauthenticated exposure
Confirming Glances REST API unauthenticated exposure
spotlight पढ़ें →
Confirming Next.js middleware bypass exposure
Confirming Next.js middleware bypass exposure
spotlight पढ़ें →
Confirming SillyTavern SearXNG external-fetch SSRF exposure
Confirming SillyTavern SearXNG external-fetch SSRF exposure
spotlight पढ़ें →
Confirming TMT Lockcell login SQL injection exposure
Confirming TMT Lockcell login SQL injection exposure
spotlight पढ़ें →
CRLF / Response Splitting
If user input lands in a response header, line breaks let the attacker write their own headers.
spotlight पढ़ें →
CSRF Protection
If your state-changing endpoints don't require a CSRF token, third-party sites can act as your users.
spotlight पढ़ें →
Missing Rate Limiting
Without rate limits on auth endpoints, the attacker can credential-stuff at line speed.
spotlight पढ़ें →
Next.js Header Configuration Drift
Headers set on `/` do not always protect nested routes.
spotlight पढ़ें →
Open Redirect
Your /redirect?url=… that doesn't validate the destination is a phishing kit.
spotlight पढ़ें →
SPIP valider_xml XSS Exposure
A legacy SPIP utility page should not reflect URL input into HTML.
spotlight पढ़ें →
07 / 07
सोर्स कोड
deephas Prototype-Pollution Advisory
A vulnerable deephas dependency can put deep-path object handling on a prototype-pollution path.
spotlight पढ़ें →
Ghost Content API SQL Injection Advisory
A vulnerable Ghost dependency can put public content APIs on the database boundary.
spotlight पढ़ें →
LibreNMS Command Injection Advisory
A vulnerable monitoring stack can become an execution path inside the network.
spotlight पढ़ें →
LiteLLM SQL Injection Advisory
A vulnerable LiteLLM Proxy version can turn API-key verification into database exposure.
spotlight पढ़ें →
NLTK Zip Slip Code Execution Advisory
A vulnerable NLTK downloader can turn compromised package archives into filesystem writes and code-execution risk.
spotlight पढ़ें →
openDCIM Command Injection Source Advisory
A database-controlled Graphviz path should not become a shell command.
spotlight पढ़ें →
TanStack ArkType Adapter Malware Advisory
Known malicious npm package versions can put CI and developer secrets at install-time risk.
spotlight पढ़ें →
vm2 Sandbox Breakout Advisory
A vulnerable JavaScript sandbox dependency can put untrusted-code boundaries at risk.
spotlight पढ़ें →
Apache Tomcat Coyote Resource-Shutdown Advisory
An affected Tomcat HTTP/2 runtime can turn reset behavior into resource exhaustion.
spotlight पढ़ें →
Apache Tomcat EncryptInterceptor Advisory
Exact affected Tomcat releases need an upgrade before cluster encryption assumptions are trusted.
spotlight पढ़ें →
Apache Tomcat h2c Request Mix-Up Advisory
Affected Tomcat h2c handling can put request data on the wrong response path.
spotlight पढ़ें →
Apache Tomcat Session-Persistence Advisory
Affected Tomcat runtimes become riskier when FileStore session persistence is enabled.
spotlight पढ़ें →
Committed AI-Generated Secrets
AI snippets should not ship provider keys into git.
spotlight पढ़ें →
Compromised codfish GitHub Action
Release workflows should not keep pointing at compromised Action refs.
spotlight पढ़ें →
electerm Install-Script Command Injection Advisory
A vulnerable terminal-client dependency can put build or developer hosts at install-time risk.
spotlight पढ़ें →
electerm Unauthorized Command Execution Advisory
A stale electerm package can matter when the vulnerable service is packaged and running.
spotlight पढ़ें →
Gogs Directory Traversal Dependency Advisory
An affected Gogs runtime can put file-upload path handling on a traversal boundary.
spotlight पढ़ें →
Gradio Windows Python Path Traversal Advisory
A vulnerable Gradio dependency becomes a stronger signal when repo config points to Windows with Python 3.13+.
spotlight पढ़ें →
Mbed TLS Buffer-Overflow Advisory
Affected Mbed TLS 3.x source evidence deserves an upgrade, not exploit reproduction.
spotlight पढ़ें →
Mbed TLS Double-Free Advisory
Legacy Mbed TLS version evidence deserves branch-aware remediation.
spotlight पढ़ें →
Microsoft ATL MS09-035 Source Advisory
Legacy ATL build metadata deserves rebuild proof, not exploit reproduction.
spotlight पढ़ें →
OpenCms XXE Information-Disclosure Advisory
A vulnerable OpenCms dependency can put XML-processing routes on a file-read boundary.
spotlight पढ़ें →
OpenSSL CMS Message-Parsing Advisory
Affected OpenSSL branch evidence deserves a branch-aware runtime upgrade.
spotlight पढ़ें →
PDF.js JavaScript Execution Advisory
A vulnerable PDF viewer can turn a malicious document into script execution.
spotlight पढ़ें →
PickleScan ZIP CRC Bypass Advisory
A vulnerable PickleScan dependency can miss malicious model archives when scans fail open.
spotlight पढ़ें →
pyLoad /flashgot RCE Advisory
A vulnerable pyLoad dependency is patch-triage evidence, not proof of live RCE.
spotlight पढ़ें →
Risky Source-Code Patterns
eval(), dangerouslySetInnerHTML, hard-coded secrets — the patterns SAST has been catching for 25 years.
spotlight पढ़ें →
SaltStack Salt Directory Traversal Advisory
A vulnerable Salt package can weaken Salt master authentication boundaries.
spotlight पढ़ें →
SAP Cloud SDK for AI Python Advisory
A vulnerable SAP Python SDK dependency is patch-triage evidence, not proof of live command execution.
spotlight पढ़ें →
Spring Data Commons Resource-Exhaustion Advisory
Affected Spring Data Commons dependencies can put property-path parsing on a DoS path.
spotlight पढ़ें →
Supabase RLS in Migrations
A public table without RLS is a future data leak.
spotlight पढ़ें →
veraPDF XSLT Injection Dependency Advisory
Affected veraPDF policy-file processing can put XSLT execution boundaries at risk.
spotlight पढ़ें →
Vulnerable Dependencies
Your package-lock.json includes thousands of packages. Some have known CVEs.
spotlight पढ़ें →
Webhook Signature Verification
If your webhook handler doesn't verify the signature, anyone can forge events.
spotlight पढ़ें →
ws Excessive-Header DoS Advisory
Affected ws server runtimes can crash when upgrade requests carry too many headers.
spotlight पढ़ें →
AI-Generated Code Guardrails
Fast AI-assisted changes need repo-level security rails.
spotlight पढ़ें →
Checking @andrei-tatar/nora-firebase-common for CVE-2024-30564
Checking @andrei-tatar/nora-firebase-common for CVE-2024-30564
spotlight पढ़ें →
Checking Apache ActiveMQ Artemis for CVE-2026-27446
Checking Apache ActiveMQ Artemis for CVE-2026-27446
spotlight पढ़ें →
Checking Apache Spark for CVE-2022-33891
Checking Apache Spark for CVE-2022-33891
spotlight पढ़ें →
Checking Cargo files for the malicious onering crate
Checking Cargo files for the malicious onering crate
spotlight पढ़ें →
Checking http4k-format-xml for CVE-2024-55875
Checking http4k-format-xml for CVE-2024-55875
spotlight पढ़ें →
Checking kill-port-process for CVE-2019-15609
Checking kill-port-process for CVE-2019-15609
spotlight पढ़ें →
Checking Log4j 1.2 JMSAppender for CVE-2021-4104
Checking Log4j 1.2 JMSAppender for CVE-2021-4104
spotlight पढ़ें →
Checking Note Mark backend for CVE-2026-44522
Checking Note Mark backend for CVE-2026-44522
spotlight पढ़ें →
Checking npm package versions and binding.gyp for the Phantom Gyp worm
Checking npm package versions and binding.gyp for the Phantom Gyp worm
spotlight पढ़ें →
Checking OpenSSL PowerPC builds for CVE-2023-6129
Checking OpenSSL PowerPC builds for CVE-2023-6129
spotlight पढ़ें →
Checking Perl GD for CVE-2026-11526
Checking Perl GD for CVE-2026-11526
spotlight पढ़ें →
Checking Red Hat npm package versions for the worm campaign
Checking Red Hat npm package versions for the worm campaign
spotlight पढ़ें →
Checking WebdriverIO BrowserStack service for CVE-2026-25244
Checking WebdriverIO BrowserStack service for CVE-2026-25244
spotlight पढ़ें →
Kubernetes Service ExternalIPs Advisory
ExternalIPs in Service manifests deserve RBAC and admission-policy review.
spotlight पढ़ें →
Mbed TLS Certificate-Validation Advisory
Affected Mbed TLS 3.x evidence deserves upgrade and client-auth review.
spotlight पढ़ें →
OpenSSL TLSv1.3 Session Memory-Growth Advisory
A vulnerable OpenSSL runtime plus no-ticket TLSv1.3 session handling can create DoS risk.
spotlight पढ़ें →
Oracle Java SE / GraalVM Runtime Advisory
Affected Oracle runtime metadata deserves an update, not DoS reproduction.
spotlight पढ़ें →
Repo Security Hygiene
Branch protection, action pinning, secret hygiene — how your repo is run matters more than the code.
spotlight पढ़ें →
Reviewing repo code against web app risk patterns
Reviewing repo code against web app risk patterns
spotlight पढ़ें →