kube-alien

Kube-alien This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys...

waf-checker

A powerful web application to test how well your Web Application Firewall WAF protects against common attack vectors. → waf-checker.com ← Features Security Testing 19+ attack categories out of the box: SQL Injection, XSS, Path Traversal, Command Injection, SSRF, NoSQL Injection, LFI, LDAP...

web-check

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: Terminal Trove The $HOME of all things in the terminal | Warp Built for coding with multiple AI agents ---|--- Contents About Screenshot Live Demo Mirror Features Usage Deployment...

macphish

macphish Office for Mac Macro Payload Generator Attack vectors There are 4 attack vectors available: beacon creds meterpreter meterpreter-grant For the 'creds' method, macphish can generate the Applescript script directly, in case you need to run it from a shell. beacon On execution, this payload...

graphql-threat-matrix

GraphQL 脅威マトリックス graphql-threat-matrix の目的 graphql-threat-matrix は、バグバウンティハンター、セキュリティ研究者、ハッカーが複数の GraphQL 実装にわたる脆弱性を発見するために構築されました。 GraphQL 実装が GraphQL 仕様をどのように解釈し準拠するかの違いは、セキュリティ上のギャップや独自の攻撃ベクトルにつながる可能性があります。異なる実装間でのセキュリティリスクを促進する要因を分析・比較することで、GraphQL...

CVE-2021-29156

CVE-2021-29156 done right This Proof of Concept is realized because the other PoC publicly available is broken ✨ Install root@kitploit: go install github.com/5amu/CVE-2021-29156@latest References https://nvd.nist.gov/vuln/detail/CVE-2021-29156...

CVE-2018-7600

POC de CVE-2018-7600 Drupal RCE CVE-2018-7600 ¡No olvides poner tu dirección en el script ! Descripción: Existe una vulnerabilidad de ejecución remota de código en múltiples subsistemas de Drupal 7.x y 8.x. Esto potencialmente permite a los atacantes explotar múltiples vectores de ataque en un...

Windows-RCE-exploits

我的另一个用于针对无文件攻击进行厂商测试的 GitHub 仓库 - https://github.com/smgorelik/VendorSimTestScripts Windows-RCE-exploits 该漏洞利用样本数据库是一个用于 WINDOWS 的 RCE （远程代码执行）漏洞利用及概念验证（Proof-of-Concepts）的仓库，样本上传仅用于红队和蓝队的教育目的。 概念验证（Proof of Concepts）始终通过在相关漏洞利用文件夹名称中的 PoC 标识，这些样本始终会弹出计算器或消息框，因此很容易被许多杀毒软件（AV）识别（从而阻止计算器 shellcode）...

CVE-2018-7600.

IGLOO Corp, Won Chi Hyun Drupal RCE 分析报告 Drupal RCE CVE-2018-7600 请务必将你的地址填入脚本中！ 描述： 在 Drupal 7.x 和 8.x 的多个子系统中存在一个远程代码执行漏洞。该漏洞可能允许攻击者利用 Drupal 站点的多个攻击向量，从而导致站点完全被入侵。 解决方案： 升级到 Drupal 7 或 8 核心的最新版本。 如果你正在运行 7.x，请升级到 Drupal 7.58。（如果无法立即更新，你可以尝试应用此补丁来修复漏洞，直到能够完全更新为止。）如果你正在运行 8.5.x，请升级到 Drupal...

CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-7232

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'parameter name' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-46610

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to...

Hackers Use Fake Claude Code Guide and AI PDFs to Spread AsyncRAT Malware

Hackers are using fake Claude Code guide and AI PDFs to spread AsyncRAT malware via Windows attack using PowerShell and Defender exclusions...

Important: postgresql

Issue Overview: Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets, PQfn..., resultisint=0, ... stores...

Exploit for CVE-2019-5513

VMware Horizon /broker/xml Vulnerability Scanner !Security...

PT-2026-42695

Name of the Vulnerable Software and Affected Versions Plonky3 versions prior to 0.4.3 Plonky3 versions prior to 0.5.3 Description An attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This...

Malicious code in ethers-wallet-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beda1480a40189cc8177ace4e3d6fd9773ad81f4cbe5a6c07e3004427846dc8d The package impersonates the legitimate @ethersproject/wallet source files are otherwise verbatim copies, including the internal version string...

Toward Securing AI Agents like Operating Systems

Autonomous agents based on large language models LLMs are rapidly emerging as a general-purpose technology, with recent systems such as OpenClaw extending their capabilities through broad tool use, third-party skills, and deeper integration into user environments. At the same time, these agentic...

SUSE CVE-2014-0598

Directory traversal vulnerability in iPrint in Novell Open Enterprise Server OES 11 SP1 before Maintenance Update 9151 on Linux has unspecified impact and remote attack vectors...

AI Native Asset Intelligence

Modern security environments generate fragmented signals across cloud resources, identities, configurations, and third-party security tools. Although AI-native security assistants improve access to this data, they remain largely reactive: users must ask the right questions and interpret...