dismember

🔪 Dismember Dismember is a command-line toolkit for Linux that can be used to scan the memory of all processes or particular ones for common secrets and custom regular expressions, among other things. It will eventually become a full /proc toolkit. Using the grep command, it can match a regular...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

PrettyTrusts

PrettyTrusts Try it out at:http://peewpw.github.io/PrettyTrusts Visualizes the output of PowerView's Get-DomainTrustMapping | Export-CSV -NoTypeInformation trusts.csv. Hand it the csv file and get a pretty diagram to play with! Should work with older and new PowerView outputs. Everything is...

pytm

pytm：一个Python式的威胁建模框架 简介 传统的威胁建模往往姗姗来迟，有时甚至根本不会进行。此外，手动创建数据流和报告极其耗时。pytm 的目标是将威胁建模前置，使其更加自动化并以开发人员为中心。 功能特性 基于您对架构设计的输入和定义，pytm 可以自动生成以下内容： 数据流图（DFD） 序列图 与您的系统相关的威胁 依赖要求 Linux/MacOS Python 3.11+ Graphviz 软件包 Java（OpenJDK 10 或 11） plantuml.jar 快速开始 tm.py 是一个示例模型。您可以运行它以生成其引用的报告和图表图像文件： mkdir -p tm...

pytm

pytm：一个基于 Python 的威胁建模框架 简介 传统的威胁建模往往在开发后期才介入，有时甚至根本不做。此外，手动创建数据流和报告可能极其耗时。pytm 的目标是将威胁建模左移，使其更加自动化并以开发者为中心。 功能 根据您对架构设计的输入和定义，pytm 可以自动生成以下内容： 数据流图 DFD 序列图 与您的系统相关的威胁 要求 Linux/MacOS Python 3.11+ Graphviz 包 Java OpenJDK 10 或 11 plantuml.jar 快速开始 tm.py 是一个示例模型。您可以通过运行它来生成它引用的报告和图表图像文件： mkdir -p tm...

CVE-2026-91197

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...

CVE-2026-2256-

CVE-2026-2256- CVE-2026-2256 示意图...

EUVD-2026-66417

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...

CVE-2026-81838

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

EUVD-2026-67232

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81753

Flowintel versions >= 3.3.0 are affected by a stored XSS vulnerability in case notes that contain Mermaid diagram blocks . Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note can store a crafted Mermaid payload that...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-77652

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer...

CVE-2026-77652

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...

CVE-2026-77652 Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...

CVE-2026-77652

A heap-based buffer overflow in the Dia diagram editor's WPG file importer (plug-ins/wpg/wpg-import.c ) allows out-of-bounds writes into a fixed 256-entry color palette. The WPG_COLORMAP record handler validates the start index only against the WPG record size, not the palette capacity, so a craf...

UBUNTU-CVE-2026-77658

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...

CVE-2026-77658

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...