CVE-2025-51396

Título del Exploit: LiveHelperChat =4.61 - Cross Site Scripting XSS Almacenado vía Telegram Bot Username Fecha: 09/06/2025 Autor del Exploit: Manojkumar J TheWhiteEvil LinkedIn: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Página del Proveedor:...

impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

stop-bots

Stop Bots A TUI, a web UI and a CLI that help you configure your server to stop bad bots without hiding behind a CDN. It works alongside NGINX and your existing firewall iptables or nftables: NGINX config. - It classifies known bots by category scanners, search engines, AI crawlers and blocks or...

vi-bot

BotDetect v2 — 生产环境机器人检测库 客户端机器人与自动化检测库，具备加权评分、行为分析、浏览器指纹识别及可配置阈值。可检测无头浏览器、Selenium、Puppeteer、Playwright、基于CDP的工具以及隐身自动化框架。 v2.1.0 — 反检测蜜罐、GPU稳定的Canvas指纹识别、增强的行为分析、惰性初始化、服务端篡改检测、请求指纹绑定及速率限制。 目录 功能特性 架构 快速开始 客户端 API 服务端集成 检测模块 配置 生产环境检查清单 测试 功能特性 28 个检测模块 ，覆盖自动化框架、无头浏览器、指纹识别、行为分析、蜜罐及堆栈跟踪陷阱 加权评分系统 ...

CVE-2025-5815-Nuclei-Template

📄 Plantilla de Nuclei para CVE-2025-5815 🚀 Descripción general Este repositorio contiene una plantilla de Nuclei específicamente diseñada para detectar una Vulnerabilidad de Deshabilitación de Registro de Bots sin Autenticación CVE-2025-5815 en el plugin Traffic Monitor de WordPress. Este problem...

mythic_telegram_profile

Perfil C2 de Telegram para Mythic Telegram proporciona un perfil C2 de Mythic para los agentes Athena y Apollo. Utiliza mensajes privados bot-a-bot de Telegram como transporte y el servicio gRPC Push C2 de Mythic como puente controlador. Arquitectura root@kitploit: Athena or Apollo agent bot...

CVE-2026-93984

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...

EUVD-2026-83589

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...

Discord-Rat

root@kitploit: ¡Solo para fines educativos! Discord Rat - Guía de instalación Autor : @deadconvicess | Empaquetado por: deadconvicess Licencia : MIT LO QUE NECESITAS 1. Python 3.11+ instalado 2. Un token de bot de Discord https://discord.com/developers/applications 3. Una URL de webhook de Discor...

CVE-2026-93984: Improper Authentication

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...

invisible_playwright v0.20.0

Playwright gets caught by anti-bots and captchas. This one runs on an anti-detect Firefox with an undetected fingerprint, compatible with your existing Playwright code. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the answers. invisibleplaywrigh...

CVE-2026-90999

creationtimestamp| type| source ---|---|--- 2026-09-17 14:13:11+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mvptl5corp2h 2026-09-17 16:39:32+00:00| seen| https://bsky.app/profile/r-netsec.bsky.social/post/3mvq3qtl4v72r 2026-09-18 14:50:04+00:00| seen|...

CVE-2026-57122

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-57122 PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-57122 PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-57122

PraisonAI (a multi-agent LLM framework) is vulnerable to fail-open webhook signature verification in its WhatsApp and Linear bot adapters prior to 4.6.59 . When WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is unset—the default on a fresh install —the _handle_webhook handler skips HMAC-SHA256 veri...

EUVD-2026-77599

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: ftcm: Fixed NULL pointer dereferencing in nexus handling The pointer tpg-tpgnexus in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can become NULL if the USB host...

Astra Linux - Vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix lockdep splat in in6dumpaddrs As reported by syzbot, we should not use rcudereference when rcureadlock is not held. WARNING: suspicious RCU usage 5.19.0-rc2-syzkaller 0 Not tainted net/ipv6/addrconf.c:5175 suspicious...

Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following...