EUVD-2026-84873

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-77912

A stored cross-site scripting (XSS) vulnerability exists in GitHub Enterprise Server within the Markdown rendering pipeline . The flaw occurs because the pipeline rewrote quote characters in already-sanitized HTML without performing subsequent re-sanitization, allowing an authenticated attacker t...

CVE-2026-91129

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-93383

A flaw was found in Google Chrome. This vulnerability, an information leak in the Permissions component, allows a remote attacker to leak cross-origin data. Exploitation occurs when a user visits a specially crafted HTML page, leading to unauthorized disclosure of sensitive information...

EUVD-2026-84804

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

uBlockOrigin-HUGE-AI-Blocklist

uBlockOrigin & uBlacklist 巨大 AI ブロックリスト 手作業で厳選された、AI 生成コンテンツを含むサイト 1000 以上 の巨大なブロックリストです。uBlock Origin または uBlacklist を使用して、画像検索エンジン Google Search、DuckDuckGo、Bing をクリーンにするためのものです。 モバイルでも動作します iOS、iPadOS、Android。uBlacklist 経由のほか、pihole/adguard でも使用可能です Hosts ファイル 経由。 PC/デスクトップへのインストール uBlock Origi...

CVE-2026-86805

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

EUVD-2026-84540

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

CORStest

CORStest 一个简单的 CORS 配置错误扫描器 基于James Kettle 的研究 CORStest 是一个用于发现跨源资源共享（CORS）配置错误的 快速 工具，使用 Python 3 编写。它接受一个文本文件作为输入，该文件可以包含域名或 URL 列表。目前，通过发送特定的 Origin 请求头并检查 Access-Control-Allow-Origin 响应头，可以检测到以下潜在漏洞： 开发后门： 不安全的开发源（如 JSFiddle 或 CodePen）被允许访问此资源 Origin 反射： 来源被简单回显在 ACAO 头中，任何站点都被允许访问此资源 Null...

bypass-firewalls-by-DNS-history

DNS履歴を悪用してファイアウォールを迂回する このスクリプトは以下を見つけようとします： Cloudflare、Incapsula、SUCURIなどのファイアウォールの背後にあるサーバーの直接IPアドレス 現在のアクティブなサイトと同じ（非アクティブで管理されていない）ウェブサイトをまだ実行している古いサーバー。A...

hakoriginfinder

hakoriginfinder リバースプロキシの背後にあるオリジンホストを発見するためのツール。WAFやその他のリバースプロキシをバイパスするのに便利です。 仕組み...

hakoriginfinder

hakoriginfinder Tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies. How does it work? This tool will first make a HTTP request to the hostname/URL that you provide and store the response, then it will make a request to every IP address...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

CloakQuest3r

如果你觉得这个 GitHub 仓库有用，请考虑给它一个 Star！⭐️ CloakQuest3r 是一款基于 Python 的安全研究工具，旨在分析和识别受 Cloudflare 及其他反向代理或 CDN 服务保护的网站可能存在的源站 IP 暴露 风险。 网站通常依赖 Cloudflare 来隐藏其源服务器 IP，以获得安全性和性能方面的优势。然而，错误配置——例如暴露的子域名、遗留的 DNS 记录或保护不当的服务——可能会无意中暴露底层服务器基础设施。 CloakQuest3r 专注于子域名枚举和被动分析技术...

theftfuzzer

┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘┴└─ 介绍： TheftFuzzer 是一款用于对跨域资源共享（CORS）实现进行常见错误配置模糊测试的工具。 用法： python theftfuzzer.py -d 'http://example.com/api/data' 帮助： python theftfuzzer.py -h root@kitploit: $ python theftfuzzer.py -h usage: theftfuzzer.py...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and...