bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

Emby Server - Authentication Bypass

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

jok3r

.. raw:: html Jok3r v3 ベータ...

zap-hud

ZAP ヘッドアップディスプレイ HUD はもはや活発に開発されていません 残念ながら、HUD は誰も焦点を当てていないため、もはや活発に開発されていません。 HUD はユニークで革新的なインターフェースであり、一部の人々に愛されていることを私たちは知っています。しかし、それにはかなりのメンテナンスが必要であり、現時点ではそれを維持するのに十分なボランティアが不足しています。 参加したい場合は、ZAP HUD グループ までご連絡ください。 HUD のメンテナンスを継続するために、実際には Java の経験を持つ人は必要ありません。それはすでにカバーされています。優れた JavaScri...

drozer

drozer drozerはAndroid向けのセキュリティテストフレームワークです。 drozerを使用すると、アプリやデバイス内のセキュリティ脆弱性を、アプリの役割を担い、Androidランタイム、他のアプリのIPCエンドポイント、および基盤となるOSと対話することで検索できます。 drozerは、公開されているAndroidエクスプロイトの利用、共有、理解を支援するツールを提供します。 drozerはオープンソースソフトウェアであり、Reversecによってメンテナンスされています。入門ユーザーガイドはReversec Labsにあります。 注意...

gitlab-profile

テストステータス : ↳ コアオーケストレーターテスター ↳ ドキュメンテーションテスター 作成日: 2025-10-24 09:50 PM ↳ Alberto Marangelo - @theGlitched !WARNING ⚠️ このプロジェクトはベータ版です！ 🎉 はい！ベータ版がまもなく完成することをお知らせいたします！バージョン0.153から、最初のV1リリースプロセスに向けたすべてのテストが開始されています！ root@kitploit: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░...

reconftw v5.0.0-beta.1

reconFTW reconFTW is a powerful automated reconnaissance tool designed for security researchers and penetration testers. It streamlines the process of gathering intelligence on a target by performing subdomain enumeration, vulnerability scanning, OSINT and more. With a modular design, extensive...

CVE-2026-66756

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

PT-2026-66571

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

EUVD-2026-45410

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialedexec.go. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published...

CVE-2026-34047

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources...

EUVD-2026-41987

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the sentineltoken setting is used in shell commands without sufficient validation, allowing an authenticated user with access to server Sentinel settings to inject shell...

CVE-2026-34058

CVE-2026-34058 : Coolify prior to 4.0.0-beta.471 is vulnerable to OS Command Injection in the Livewire component Server\Resources. The public methods startUnmanaged, stopUnmanaged, and restartUnmanaged accept a container ID directly from the browser without sanitization, and this value is interpo...

CVE-2026-32718 Coolify read-scoped API tokens can perform state-changing validation operations

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and...

PT-2026-55770

Name of the Vulnerable Software and Affected Versions nextlevelbuilder GoClaw versions prior to 3.13.0-beta.3 Description An issue exists in the WebSocket RPC Handler component within the MethodRouter.Handle function of the internal/gateway/router.go file. This flaw allows for remote manipulation...

CVE-2026-27883

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the GET /api/v1/deployments/uuid endpoint allows any authenticated user to access deployment details belonging to any team, bypassing team-based authorization. The $teamId ...

CVE-2026-13508

Affects khoj-ai khoj versions up to 2.0.0-beta.28; vulnerable component is the Conversation Sharing Handler in src/khoj/routers/api_chat.py, where manipulation of conversation.agent leads to incorrect authorization. The issue enables remote exploitation (exploit published) with attack vector over...

CVE-2026-47777 Mastodon has a consent-check bypass in its remote Collections

Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in a remote Collection could lead to attackers bypassing the check and faking consent. An attacker could forge the...

CVE-2026-10285 DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization

A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack i...

CVE-2026-44287

FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356 blocks dynamic import with the regex /\bimport\s\/.testcode. JavaScript syntax accepts a block comment between import and ; the regex matches only ASCII...