202605_dirty_frag

202605dirtyfrag CVE-2026-43284 与 CVE-2026-43500 由 Hyunwoo Kim 发现...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

POC-DUMP

POC-DUMP 我所发现的任何有趣 bug/漏洞的 Writeup 或脚本。 当前已收录的 CVE（持续增加中）： • CVE-2021-35475 • CVE-2022-36194 • CVE-2022-36667 • CVE-2022-36668 • CVE-2022-36669 • CVE-2022-37137 • CVE-2022-37138 • CVE-2022-37139 • CVE-2022-37140 • CVE-2022-3211 • CVE-2022-3231...

cves-2025-11187_15467_69418

不是我的发现。一直没有时间做完整的利用链，不过大约有 80% 可打穿；bfcanary 需要一个真实的目标。 祝好运 CVE 列表 CVE| 类型| 严重性| 描述 ---|---|---|--- CVE-2025-11187| 栈溢出| 高| PKCS12 PBMAC1 keyLength 校验绕过 CVE-2025-15467| 栈溢出| 高| CMS AuthEnvelopedData IV 长度溢出 CVE-2025-69418| 信息泄露| 中| OCB 模式部分分块加密失败 构建 make all OPENSSLPATH=/path/to/vulnerable/openssl...

Xstream-1.4.17

Xstream-1.4.17 （以上Xstream Demo环境经本人搭建，漏洞利用环境以JDK1.8u131为准，现支持本地测试和HTTP远程发包） XSTREAM=1.4.17漏洞复现（CVE-2021-39141、CVE-2021-39144、CVE-2021-39150、CVE-2021-39152） 不提供本实验利用POC，仅展示复现利用效果，为避免恶意人员的利用，仅提供官网POC：http://x-stream.github.io/changes.html CVE-2021-39141（RCE）...

nmap-vulnerability-scan-scripts

Synopsys CyRC 漏洞公告：https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps.html CVE-2022-45477, CVE-2022-45479, CVE-2022-45482, CVE-2022-45481...

CVEs-for-picoc-3.2.2

CVEs-for-picoc-3.2.2 CVE-2022-44312 から CVE-2022-44321 までの再現ファイル CVE リファレンス PicoC v3.2.2 の expression.c 内 ExpressionCoerceInteger 関数におけるヒープオーバーフロー CVE-2022-44312 PicoC v3.2.2 の expression.c 内 ExpressionCoerceUnsignedInteger 関数におけるヒープオーバーフロー CVE-2022-44313 PicoC v3.2.2 の cstdlib/string.c 内...

ioctlance

IOCTLance Description Presented at CODE BLUE 2023, this project titled Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model WDM drivers. In a...

zap-scripts

zap-scripts Zed Attack Proxy Scripts for finding CVEs and Secrets. Building This project uses Gradle to build the ZAP add-on, simply run: ./gradlew build in the main directory of the project, the add-on will be placed in the directory build/zapAddOn/bin/. Usage The easiest way to use this repo in...

zipbrk

zipbrk 2.2.0 Zip breakは、zipファイルを解析、修正、再構築するためのツールです。多様なタスクに対応するよう設計されており、クロスプラットフォームで、さまざまなシステムへの移植ができるだけ簡単になるように作られています。Windows 9x/2k/XP、Windows Vista/7/8、Fedora 23/24/25/26/27、Kali、Debian 8/9、Qubes 3.2/4.0、Whonix 13/14、Ubuntu 10、FreeBSD 11、およびさまざまなAndroidフォンでテストされています。Linux/UNIXマシンでコンパイルするには、単に...

patch-checker

PatchChecker This is the code base for the service running on: https://patchchecker.com. In short, PatchChecker is a web application running on flask that provides output similar to that of Watson. However by using PatchChecker, one is not required to execute a binary on the target machine...

bluemonday

bluemonday bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against an allowlist of approved HTML elements and attributes so that you can safely include...

missing-cve-nuclei-templates

nuclei 模板官方仓库中缺失 CVE 的每周更新列表 注意 此仓库 100% 自动化，因此可能存在错误，但总体而言相当准确。请转到“工作原理”部分以了解数据是如何收集的。 统计 📊 已分析的 CVE ：174067 缺失的 CVE ：68723 按漏洞类型下拉 ： 类型| 数量| 数据 ---|---|--- XSS| 23811| xss.txt RCE| 3669| rce.txt SQL 注入| 13683| sqli.txt 本地文件包含| 392| lfi.txt 服务端请求伪造| 504| ssrf.txt 原型污染| 324| proto-pollution.txt...

manul

Manul Manul is a coverage-guided parallel fuzzer for open-source and black-box binaries on Windows, Linux and macOS beta written in pure Python. Quick Start pip3 install psutil git clone https://github.com/mxmssh/manul cd manul mkdir in mkdir out echo "AAAAAA" in/test python3 manul.py -i in -o ou...

versionscan

versionscan Versionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. PLEASE NOTE: Work is still in progress to adapt the tool to linux distributions that backport security fixe...

CLSA-2026-1790776009 TuxCare security update for org.yaml:snakeyaml (3 CVEs)

TuxCare rebuilt org.yaml:snakeyaml to address 3 CVEs. Fixed in 1.27-tuxcare.2...

CLSA-2026-1790767846 TuxCare security update for axios (10 CVEs)

TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.0-tuxcare.1...

CLSA-2026-1790755546 TuxCare security update for @xmldom/xmldom (14 CVEs)

TuxCare rebuilt @xmldom/xmldom to address 14 CVEs. Fixed in 0.7.13-tuxcare.1...

CLSA-2026-1790751161 TuxCare security update for io.netty (18 CVEs)

TuxCare rebuilt 47 io.netty packages to address 18 CVEs. Fixed in 4.1.87.Final-tuxcare.1...

CVE-2018-13379

IOC's for CObalt Strike/CVE-2018-13379 所有荣誉归功于 Awake/Arista/https://www.linkedin.com/in/kevin-romano-48071a42/ IOC复制自 DD: https://awakesecurity.com/blog/exploiting-cve-2018-13379-a-case-study-of-threat-actors-exploiting-years-old-cves/...