zeroboot

Sub-millisecond VM sandboxes for AI agents via copy-on-write forking Try it curl -X POST https://api.zeroboot.dev/v1/exec \ -H 'Content-Type: application/json' \ -H 'Authorization: Bearer zbdemohn2026' \ -d '"code":"import numpy as np; printnp.random.rand3"' Benchmarks Metric| Zeroboot| E2B|...

RED_HAWK

Version 2.0.0 By R3D@0R2H1N A.K.A Tuhinshubhra All in one tool for Information Gathering and Vulnerability Scanning Scans That You Can Perform Using RED HAWK : Basic Scan Site Title NEW IP Address Web Server Detection IMPROVED CMS Detection Cloudflare Detection robots.txt Scanner Whois Lookup...

ejbca-pqc-lab

EJBCA Pure PQC Lab — ML-DSA-65 Two-Tier PKI Hierarchy A hands-on implementation of NIST FIPS 204 ML-DSA in a two-tier PKI hierarchy using EJBCA Community Edition. 📖 Full walkthrough: Building a Post-Quantum PKI: How I Signed a Root CA and Sub CA Using ML-DSA on EJBCA What This Lab Builds A comple...

RFCrack

/ | | | / | | | | / \ ' - / \ / - | / \ V V / ' / \ || - /||// /| ///|. //, / / |/ | /| | | || | / | | '/ /| / / | || || , | \ Welcome to RFCrack - A Software Defined Radio Attack Tool Developer: @Ficti0n - http://ConsoleCowboys.com CCLabs: http://cclabs.io Blog: console-cowboys.blogspot.com...

domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

ct-exposer

Discover sub-domains by searching through Certificate Transparency logs What is CT? Certificate Transparency CT is an experimental IETF standard. The goal of it was to allow the public to audit which certificates were created by Certificate Authorities CA. TLS has a weakness that comes from the...

CVE-2026-97174

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the...

CVE-2026-97174

A flaw in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak allows an attacker to perform a sub parameter injection . The CIBA endpoint fails to properly validate the sub parameter, enabling it to be stored as an additional request parameter. During token issuance,...

EUVD-2026-117610

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the...

CVE-2026-97174

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the...

phantom-brain

PHANTOM BRAIN v0.9 Offline AI-powered pentesting analysis tool with real hardware integration Local LLM analysis via Ollama for WiFi, Sub-GHz, NFC/RFID and WPA2 captures — no internet required, no cloud APIs, 100% offline. The main LLM runs on a Windows PC. The Raspberry Pi acts as a lightweight...

PT-2026-137582

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the...

ChaosKobra

ChaosKobra 🐍 Another Sub-Domain Enumeration Tools for normies written in Python3. 🔧 Technologies & Tools 📚 Requirements Python 3.9+ pip3 Installation Use the package manager pip to install the requirements. if not installed, install it using the following command. sudo apt-get install python3-pip...

CVE-2026-118422

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned fr...

CVE-2026-118422

The Stape Conversion Tracking WordPress plugin (versions before 2.3.11 ) is vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) . The root cause is a failure to validate the sub-path appended to its same-origin proxy's upstream endpoint. This allows unauthenticated vis...

EUVD-2026-116735

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned fr...

CVE-2026-118422 Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned fr...

CVE-2026-121415

Parse Server versions before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 using MongoDB are vulnerable to field corruption. The root cause is that the server skips field type validation for null-valued dot notation keys , which allows an attacker to write sub-documents beneath existing Pointer, Number...