EUVD-2026-95164

IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHODNEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileg...

CVE-2026-106434

The MongoDB libmongocrypt explicit decryption component is vulnerable to an integrity issue where it may return an unrecognized encrypted payload unchanged rather than returning a decryption error. This occurs due to improper validation of integrity check values (CWE-354) . An actor capable of mo...

EUVD-2026-95163

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application...

android-forensics

android-forensics AFLogical OSE：开源安卓取证应用与框架 开源版（OSE）已面向非执法人员、安卓爱好者及取证专家发布。它允许检查员从安卓设备中提取通话记录、联系人电话、彩信、彩信附件及短信。完整版AFLogical软件可免费提供给执法人员使用。更多信息请访问 https://www.nowsecure.com/ 安装 编译或下载最新APK。另外，AFLogical OSE已预装于santoku linux 然后将APK文件安装到设备。可将APK复制到设备后直接运行，或使用adb shell。 示例： adb install...

google_socks

此脚本用于允许两个套接字通过Google Drive中继数据进行通信。 查看此博客文章了解更多详情。 设置过程 安装所需的Python模块（见下文） 运行 "python2 ./googlesocks.py --setup" 并按照说明操作 创建一个Google API项目 为项目创建OAuth客户端ID凭据 下载这些凭据的JSON文件 将凭据文件移动到googlesocks目录并将其命名为"clientsecrets.json" 接着，设置脚本会给你一个Google链接并要求输入密钥 点击链接，授权脚本使用API，并获取密钥 将密钥粘贴回设置脚本的提示中...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

CVE-2025-14847_Expolit

MongoBleed-Pro ☠️ 高级 MongoDB 内存泄漏利用工具 保持学习 | 保持黑客精神 - Alexcyberx 🔥 关于 MongoBleed-Pro 是一款针对 CVE-2025-14847 的高级利用工具，该漏洞是 MongoDB 在 zlib 压缩处理中存在的严重内存泄露漏洞。该工具允许安全研究人员从存在漏洞的 MongoDB 实例中提取敏感数据。 ⚠️ 免责声明 本工具仅供 授权的安全测试和教育目的 使用。未经授权访问计算机系统属于违法行为。在测试前请务必获得适当授权。 💀 漏洞详情 属性| 详情 ---|--- CVE ID| CVE-2025-14847...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980环境 Build docker environment docker build -t mongo . docker run -dit -p 6666:6666 mongo Poc ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...

CVE-2026-105452

Docker Sandboxes are vulnerable to a flaw in the egress proxy , which may forward unrecognized client-supplied credentials alongside credentials injected by the host. The proxy only removes alternate credentials if they match specific known sentinel values; consequently, untrusted code within an ...

EUVD-2026-95159

Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox could supply an unrecognized credential in...

AzureHound

AzureHound 用于 Microsoft Azure 的 BloodHound 数据收集器 获取 AzureHound 发布二进制文件 请从我们的 Releases 页面下载适用于您平台的二进制文件。 滚动发布 滚动发布包含预构建的二进制文件，这些文件会自动与 main 分支保持同步，可从 此处 下载。 警告： 滚动发布可能不稳定。 编译 先决条件 Go 1.25 或更高版本 要从源代码构建此项目，请运行以下命令： go build -ldflags="-s -w -X...

vuln-list-update

vuln-list-update 自动收集漏洞信息并以可解析的格式保存 数据 https://github.com/aquasecurity/vuln-list/ 用法 $ vuln-list-update -h Usage of vuln-list-update: -target string update target nvd, alpine, alpine-unfixed, redhat, redhat-oval, debian, ubuntu, amazon, bottlerocket, oracle-oval, suse-cvrf, photon, arch-linux,...

pict

PICT - 感染后收集工具包 这套脚本旨在从被认为已感染的终端收集各类数据，以协助应急响应流程。这些数据不应被视为完整的取证数据收集，但确实捕获了大量有用的取证信息。 如需真正的取证数据，您应实际捕获完整的内存转储并对整个驱动器进行镜像。这不在本工具包的范围内。 使用方法 脚本必须在运行中的系统上执行，而非镜像或其他取证数据存储库。它严格来说并不 要求 root 权限才能运行，但若无 root 权限，将无法收集大部分预期数据。 数据将以两种形式收集。第一种是汇总文件，包含 shell 命令输出、从数据库提取的数据等。例如，browser 模块会输出一个...

socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

CVE-2026-106430

The MongoDB C++ Driver is vulnerable to query and rename target confusion due to embedded NUL truncation . The driver discards content following a NUL byte in specific field and collection names accepted by the collection API , leading to a discrepancy between how the driver and the calling appli...

EUVD-2026-95155

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an...

CVE-2025-8088-Winrar-Tool-Gui

🚨 CVE-2025-8088 WinRAR 漏洞利用工具 ⚠️ 仅供教育和研究使用 ⚠️ 🌐 语言 / Dil 🇺🇸 English 🇹🇷 Türkçe English 📋 目录 概述 功能特性 环境要求 安装 使用说明 技术细节 截图 免责声明 贡献 🎯 概述 CVE-2025-8088 是一个虚构的漏洞演示工具，用于展示 RAR 压缩文件中的路径遍历攻击 。该教育工具演示了恶意压缩包如何利用目录遍历技术将文件解压到预期目录之外。 🔍 该工具的功能： 创建特制的 RAR 压缩包 演示路径遍历漏洞 使用高级数据流（ADS）技术 通过 AES 加密实现载荷混淆 针对 Windows...

anubis

Anubis d8888 888 d8b d88888 888 Y8P d88P888 888 d88P 888 88888b. 888 888 88888b. 888 .d8888b d88P 888 888 "88b 888 888 888 "88b 888 88K d88P 888 888 888 888 888 888 888 888 "Y8888b. d8888888888 888 888 Y88b 888 888 d88P 888 X88 d88P 888 888 888 "Y88888 88888P" 888 88888P' Anubis...