sysflow

SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...

CVE-2025-64513

CVE-2025-64513 – Milvus Proxy Authentication Bypass Vulnerability PoC 📘 Overview This repository contains a proof-of-concept PoC script to verify the existence of CVE-2025-64513 , a critical authentication bypass vulnerability in Milvus Proxy that may allow unauthorized access to internal APIs...

CVE-2025-46818

CVE-2025-46818 – Redis Lua Sandbox Cross-User Escape Sandbox escape via deprecated Lua APIs and mutable metatables on Redis 8.2.1. Overview Redis 8.2.1 keeps deprecated Lua builtins getfenv, setfenv, newproxy exposed to scripts and fails to lock metatables for basic types. An attacker can inject...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 References respect to the masters: CVE-2023-50386 vulnerability author's blog Java Security Manager Bypass Techniques Bypassing Reflection Protection in JDK 17 JNI Bypassing RASP Vulnerability exploitation...

CVE-2026-118022

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-118010

Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-117970

Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

SUSE CVE-2026-116582

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script...

SUSE CVE-2026-116583

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

SUSE CVE-2026-118010

Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

SUSE CVE-2026-118022

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

PT-2026-129165

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

SUSE CVE-2026-117970

Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

Securiscan

Securiscan Securiscan Securiscan is a robust, lightweight, and native standard-library security triage engine built to analyze vulnerabilities across Web Applications, APIs, LLMs, and Mobile Packages completely using Python standard built-ins. 🚀 Core Execution Modes 1. Passive External Inspection...

cve-2026-46391

CVE-2026-46391 - Credential Exposure via SSRF in @haxtheweb/open-apis Proof of concept for CVE-2026-46391. Triggers the SSRF vulnerability in the cacheAddress endpoint of @haxtheweb/open-apis and captures the service account credentials sent in the callback. Build go build -o cve-2026-46391 . Tes...

CVE-2026-87897

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...

EUVD-2026-111132

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...

CVE-2026-118022

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-118010

Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...