python-codext

CodExt 编码/解码一切。 CodExt 是一个（兼容 Python 2 和 3）库，它扩展了原生 codecs 库（即用于添加新的自定义编码和字符映射），并提供了 120+ 个新的 codecs ，因此得名，意为 CODecs EXTension （编解码器扩展）。它还提供了一个 猜测模式 ，用于解码多层编码，以及便捷的 CLI 工具 。sh $ pip install codext root@kitploit: 想要贡献一种新的编解码器？|想要贡献一种新的宏？...

9Router <= 0.4.36 - Unauthenticated RCE

9Router = 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/ and /api/mcp/ entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, the...

whad-client

WHAD: Dispositivos de hacking inalámbrico Este framework proporciona un conjunto de herramientas de línea de comandos para jugar/hackear/explorar protocolos y dispositivos inalámbricos, así como una librería para crear potentes herramientas inalámbricas para usar con dispositivos hardware que...

jsteg

jsteg root@kitploit: go get lukechampine.com/jsteg jsteg is a package for hiding data inside jpeg files, a technique known as steganography. This is accomplished by copying each bit of the data into the least-significant bits of the image. The amount of data that can be hidden depends on the...

CTT-Enhanced-CVE-2026-46339-Exploit-Engine

CTT-Enhanced-CVE-2026-46339-Exploit-Engine Un framework especializado en Python que ejecuta ejecución remota de código no autenticada a través del puente del Model Context Protocol MCP de 9Router, implementando una cascada de fases temporales de 33 capas, dispersión de Riemann-Hadamard y un filtr...

thethe

威胁狩猎环境 你是一名威胁猎人。在进行调查时，你是否发现自己浏览器中打开了超过20个标签页，散落着带有数据的.txt文件，以及一些终端在后台运行？ theTHE将一次调查中的所有信息集中到一个项目中，并与你的团队（且仅与团队）共享结果。theTHE会缓存你的API响应，因此你无需重复请求。不要共享你的密钥，让用户自行调用服务。 theTHE还集成了一些命令行工具，这样你就不必打开终端并将结果重定向到.txt文件中。 欢迎提供反馈。 更新内容 参见 发布页 安装 有一个 install.sh 脚本可简化安装。你可以下载并执行它： root@kitploit: curl -sSL...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 includes significant modernization changes: Python 3.9+ required - Dropped support for Python 3.6, 3.7, and 3.8 attrs library removed - Data classes now use Python's built-in dataclasses module If your code imports internal classes Cell,...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 includes significant modernization changes: Python 3.9+ required - Dropped support for Python 3.6, 3.7, and 3.8 attrs library removed - Data classes now use Python's built-in dataclasses module If your code imports internal classes Cell,...

PYSEC-2026-2908 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

Summary The fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py: "registers four file-handling tools by default, praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and...

MAL-2026-7005 Malicious code in visa-cli-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0e8f566e285de1eec2c3cae07b0faaa8828080a4e1fed7e76e1fe43dfa571ec Package presents as an internal-looking corporate tooling name 'visa-cli-tools' published at an inflated version 99.9.1 — the canonical...

Malicious code in visa-cli-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0e8f566e285de1eec2c3cae07b0faaa8828080a4e1fed7e76e1fe43dfa571ec Package presents as an internal-looking corporate tooling name 'visa-cli-tools' published at an inflated version 99.9.1 — the canonical...

PT-2026-42036

Name of the Vulnerable Software and Affected Versions 9router versions 0.4.30 through 0.4.36 Description 9router contains a flaw where the Next.js middleware fails to protect several API endpoints, allowing unauthenticated network-adjacent attackers to execute arbitrary OS commands as the user...

EUVD-2019-17185

Malware in sbrugna...

EUVD-2019-0003

Malware in sbrugna...

GHSA-X4RX-4GW3-53P4 vulnerabilities

Vulnerabilities for packages: dagger, apko, trufflehog, k9s, zarf, trivy, tw, openfga, buildah, opentelemetry-collector, buildkitd, zot, falcoctl, syft, kargo, cadvisor, osv-scanner, wolfictl, buf, docker-compose, goreleaser, splunk-otel-collector, grype, docker-cli-buildx, melange,...

postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

A flaw was found in PostgreSQL. Due to improper neutralization of quoting syntax, affected versions potentially allow a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the affected function's result to constru...

RHEL 8 : Red Hat OpenShift Serverless Client kn 1.12.0 (Moderate) (RHSA-2021:0145)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0145 advisory. Red Hat OpenShift Serverless Client kn CLI is delivered as an RPM package for installation on RHEL platforms, and as binaries for non-Linux...

USN-6773-1: .NET vulnerabilities

It was discovered that .NET did not properly handle memory in it's Double Parse routine. An attacker could possibly use this issue to achieve remote code execution. CVE-2024-30045 It was discovered that .NET did not properly handle the usage of a shared resource. An attacker could possibly use th...

BIT-RABBITMQ-2021-32718 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...

Fedora: Security Advisory for kde-cli-tools (FEDORA-2023-e31c3e4b6c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...