Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

OSXAuditor

OS X Auditor OS X Auditor is a free Mac OS X computer forensics tool. OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze: the kernel extensions the system agents and daemons the third party's agents and daemons the old and...

Skadi

pronounced “SKAH-Dee”: similar to Scotty but with a d sound is a giantess and goddess of hunting in Norse mythology Please Read Open Letter to the users of Skadi, CyLR, and CDQR Purpose Skadi is a free, open source collection of tools that enables the collection, processing and advanced analysis ...

omnibus

OSINT Omnibus Developed & maintained by InQuest Table of Contents OSINT Omnibus Omnibus Documentation Vocabulary Running Omnibus API Keys Interactive Console Artifacts Overview Creating & Managing Artifacts Sessions Modules Machines Reporting Monitoring Modules OSINT Omnibus Developed & maintaine...

Fastir_Collector

FastIR Collector We changed our approach to live forensics acquisition, which means FastIR Collector is no longer maintained. We recommend using our newFastIR Artifacts collector instead Concepts This tool collects different artefacts on live Windows and records the results in csv or json files...

Meerkat

Meerkat Meerkat is collection of PowerShell modules designed for artifact gathering and reconnaissance of Windows-based endpoints without requiring a pre-deployed agent. Use cases include incident response triage, threat hunting, baseline monitoring, snapshot comparisons, and more. Artifacts Host...

CVE-2026-100653

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin --revision / --code-revision is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the...

CVE-2026-100653 vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin --revision / --code-revision is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the...

EUVD-2026-87720

Capgo capgo.app exposes a native build TUS upload proxy supabase/functions/backend/public/build/upload.ts that authorizes a caller against a single build job identified by the supplied builderjobid and validates only that job's stored uploadpath, but then forwards the user-controlled TUS resource...

Fennec

Fennec 🦊 fennec is an artifact collection tool written in Rust to be used during incident response on nix based systems. fennec allows you to write a configuration file that contains how to collect artifacts. Features 🌟 🦀 A single statically compiled binary 🔬 Execute any osquery SQL query 💻 Execu...

KapeFiles

KAPE Files コミュニティが作成した KAPE 用のターゲットとモジュール KAPE をダウンロード · バグを報告 · 機能をリクエスト KapeFiles KAPE概要 KAPE は、効率的で高度に構成可能なトリアージプログラムであり、基本的にあらゆるデバイスやストレージの場所を対象に、法医学的に有用なアーティファクトを発見し、数分以内に解析します。KAPE は こちら からダウンロードできます。 詳細なドキュメントについては、こちら を参照してください!! このURLは常に最新のドキュメントです。 KAPEライセンス 注: 商用アプリケーションでの KAPE...

ForensicMiner

ForensicMiner v1.4 "ForensicMiner, DFIR 자동화를 재정의하다" 제작 및 유지보수: Eilay Yosfan ForensicMiner란 무엇인가? ForensicMiner는 PowerShell 기반의 DFIR 자동화 도구로, 디지털 조사 분야에 혁신을 가져옵니다. 효율성을 염두에 두고 설계되어 Windows 머신에서 아티팩트 및 증거 수집을 자동화합니다. Falcon Crowdstrike RTR 및 Palo Alto Cortex XDR Live Terminal과의 호환성, 빠른 성능, 사용자 친화적인...

plaso

Plaso Plaso Langar Að Safna Öllu - super timeline all the things Plaso Plaso Langar Að Safna Öllu, or super timeline all the things , is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creati...

whids

중요: 이 README와 다른 문서는 최신 베타 릴리스의 변경 사항을 반영하도록 업데이트되지 않았습니다 많은 변경이 있었기 때문. 안정 버전이 출시될 때 시간이 지남에 따라 모두 업데이트될 예정입니다 다음 릴리스까지의 로드맵 참조. 베타 릴리스를 직접 실행하고 도움이 필요하면 질문하셔도 됩니다. 무엇인가 EDR with artifact collection driven by detection. Detection 엔진은 Windows 이벤트를 사용자 정의 규칙과 매칭하도록 특별히 설계된 이전 프로젝트 Gene 위에 구축되었습니다...

whids

IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...

uac

Unix 계열 아티팩트 수집기 UAC 소개 • 문서 • 주요 기능 • 지원 운영체제 • 사용법 • 기여 • 지원 • 라이선스 🔎 UAC 소개 UAC Unix 계열 아티팩트 수집기는 포렌식 조사관, 보안 분석가 및 IT 전문가를 위해 설계된 강력하고 확장 가능한 침해 대응 도구입니다. AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD, Solaris를 포함한 다양한 Unix 계열 시스템에서 아티팩트 수집을 자동화합니다. 침해 대응, 포렌식 조사 또는 규정 준수 확인을 수...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC & Reproduce このリポジトリには、MLflow の Local File Inclusion LFI 脆弱性（CVE-2023-1177）に対する Proof-of-Concept PoC エクスプロイトコードと再現手順が含まれています。 脆弱性情報: CVE ID: CVE-2023-1177 脆弱性の種類: Local File Inclusion LFI / Path Traversal 影響を受けるバージョン: MLflow = 2.2.1（NVD では 2.2.1 とされていますが、筆者の確認では 2.3.1 以降...

cosign

cosign Sigstore を使用して OCI コンテナ（およびその他のアーティファクト）に署名します! Cosign は、署名を見えないインフラストラクチャ にすることを目指しています。 Cosign は以下をサポートしています: Sigstore のパブリックグッド Fulcio 認証局と Rekor 透過性ログを使用した「キーレス署名」（デフォルト） ハードウェアおよび KMS 署名 cosign が生成した暗号化された秘密鍵/公開鍵ペアによる署名 OCI レジストリでのコンテナの署名、検証、保存。 Bring-your-own PKI（独自 PKI の持ち込み） 情報...

gha-lab-25b7988758

自動化された研究アーティファクト — 上流プロジェクトではありません。 このリポジトリは、公開されたGitHub Actionsワークフローの脆弱性の再現に関するラヴァル大学の修士論文のために、自動化ハーネスによって構築された使い捨てラボです。これは、live-codes/livecodes のコミット 8017e0146fc020b8e9ec4115afc6f7b228354e46（2026-02-21）の逐語的なスナップショットであり、そのプロジェクト自身のライセンスの下で再配布されており、そのライセンスファイルはこのスナップショットに変更なしで含まれています。...

ubuntils

ubuntils ライブな Ubuntu システム向けのフォレンジックトリアージ — 5 秒未満で自動化されたアーティファクト収集、永続化検出、ガイド付き修復。 問題点 Linux システムが侵害された疑いがある場合、最初の 30〜40 分は通常、同じ 10 個のコマンドを順番に実行するのに費やされます。実行中のプロセスを確認し、怪しい cron ジョブを探し、LDPRELOAD を grep し、authorizedkeys に新しいエントリがないかスキャンし、sudoers を監査する。各ステップは手動で、コンテキストスイッチが発生し、プレッシャーの中でミスをしやすいものです。1...