pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

CVE-2025-32013

CVE-2025-32013 Security Advisory and PoC for CVE-2025-32013 How to Use 1. Start here: Read this README file for an overview of the repository structure and contents. 2. Internal Security Advisory: Open 01SecurityAdvisory.md to see the detailed write-up addressing the vulnerability, its impact, an...

bearer

Scan your source code against top security and privacy risks. Bearer is a static application security testing SAST tool designed to scan your source code and analyze data flows to identify, filter, and prioritize security and privacy risks. Bearer offers a free, open solution, Bearer CLI, and a...

pytm

pytm: Un marco Pythonico para modelado de amenazas Introducción El modelado de amenazas tradicional a menudo llega tarde a la fiesta, o a veces no llega en absoluto. Además, crear flujos de datos e informes manuales puede ser extremadamente lento. El objetivo de pytm es desplazar el modelado de...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

ScratchABit

ScratchABit ScratchABit is an interactive incremental disassembler with data/control flow analysis capabilities. ScratchABit is dedicated to the efforts of the OpenSource reverse engineering community reverse engineering to produce OpenSource drivers/firmware for hardware not properly supported b...

paimei

PaiMei, is a reverse engineering framework consisting of multiple extensible components. The framework can essentially be thought of as a reverse engineer's swiss army knife and has already been proven effective for a wide range of both static and dynamic tasks such as fuzzer assistance, code...

ABD

Advanced Binary Deobfuscation This repository contains the course materials of Advanced Binary Deobfuscation at the Global Cybersecurity Camp GCC Tokyo and the Security Camp National Workshop in 2020. Course Abstract Reverse engineering is not easy, especially if a binary code is obfuscated. Once...

caracal

Caracal Caracal es una herramienta de análisis estático sobre la representación SIERRA para contratos inteligentes de Starknet. Características Detectores para detectar código Cairo vulnerable Impresoras para reportar información Análisis de taint Marco de análisis de flujo de datos Fácil de...

caracal

Caracal Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. Features Detectors to detect vulnerable Cairo code Printers to report information Taint analysis Data flow analysis framework Easy to run in Scarb projects Installation Precompiled binaries...

threatspec

threatspec - modelado de amenazas continuo, a través del código Threatspec es un proyecto de código abierto que tiene como objetivo cerrar la brecha entre el desarrollo y la seguridad al incorporar el proceso de modelado de amenazas más profundamente en el proceso de desarrollo. Esto se logra...

threatspec

threatspec - continuous threat modeling, through code Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write...

polytracker

PolyTracker PolyTracker is a tool originally created for the Automated Lexical Annotation and Navigation of Parsers , a backronym devised solely for the purpose of referring to it as The ALAN Parsers Project. However, it has evolved into a general purpose tool for efficiently performing data-flow...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon es una aplicación gratuita, de código abierto y multiplataforma de modelado de amenazas que incluye diagramación del sistema y un motor de reglas para generar automáticamente amenazas/mitigaciones. Es un Proyecto Incubador de OWASP. El enfoque del proyecto está e...

route-sixty-sink

✏️ Contributors Dillon Franke @dillonfranke Michael Maturi @a-marionette 📝 Blog https://www.mandiant.com/resources/route-sixty-sink-launch ⚓ Route Sixty-Sink Route Sixty-Sink is an open source tool that enables defenders and security researchers alike to quickly identify vulnerabilities in any .NE...

drawio-threatmodeling

Draw.io libraries for threat modeling This is a collection of custom libraries to turn the free and cross-platform Draw.io diagramming application into the perfect tool for threat modeling. Data Flow Diagrams Data Flow Diagramming is a simple diagramming technique used to gain an understanding of...

DRUPAL-CONTRIB-2026-074

The Events, Conditions, Actions ECA module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is...

ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

The Events, Conditions, Actions ECA module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is...

PT-2026-50776

Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Description A flaw in the HTTP/2 server API allows servers to continue accepting data after a GOAWAY frame has been sent. A GOAWAY frame is a mechanism used in the HTTP/2 protocol to notify the peer that t...

MAL-2026-5588 Malicious code in 0x2ai-demo10x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c4c4b3e66489f3a4383df5e62540498343c5ab3a5ce145df5733b2820efc71b On npm install, scripts/postinstall.cjs runs fs.cpSyncpayload, process.env.INITCWD, recursive: true , copying.mcp.json,...