monitor v0.41.0

BetterDB Monitor The monitoring layer that Valkey deserves. BetterDB persists what Valkey throws away - slowlogs, command patterns, client activity, anomaly signals - so you can debug what happened at 3am, not just what's happening now. Built for Valkey 8.x with native support for COMMANDLOG,...

gha-lab-227431b300

Kiwi TCMS - Open-Source-Testmanagement .. image:: https://img.shields.io/docker/pulls/kiwitcms/kiwi :target: https://kiwitcms.readthedocs.io/en/latest/installingdocker.html :alt: Downloads from Docker Hub .. image:: https://readthedocs.org/projects/kiwitcms/badge/?version=latest :target:...

faraday v5.23.2

Open Source Vulnerability Manager Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your termin...

ReconTitan

A security-hardened platform for external reconnaissance, OSIN...

iris-web v2.4.29

Incident Response Investigation System Current Version v2.4.20 Online Demonstration IRIS Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Table of contents Getting Started Run IrisWeb Configuration Versioning Showcase...

Kimai-CVE-2026-49865-POC — Updated!

Kimai CVE-2026-52824 — Default APPSECRET Authentication Bypass Note: The repository URL contains an outdated CVE ID CVE-2026-49865. The correct and current CVE tracked in this repository is CVE-2026-52824 GHSA-jr9p-4h4j-6c58. Proof-of-concept exploit toolkit for the hardcoded default APPSECRET...

CVE-2026-53985

CVE-2026-53985 affects Ground Station prior to version 0.6.0. It describes an unauthenticated denial-of-service in the Socket.IO server’s service_control event handler, allowing an unauthenticated network peer to forcibly terminate the ground-station process by sending a restart_service command. ...

CVE-2026-53975

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

nikto v2.6.1

nikto Nikto web server scanner - https://cirt.net/Nikto2 Full documentation - https://github.com/sullo/nikto/wiki Run normally: root@kitploit: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.co...

Sirius v1.1.0

Sirius Scan Sirius is an open-source vulnerability scanner with automated discovery, CVE-based detection, and a modern web UI. Clone, run four commands, start scanning. Quick Start root@kitploit: git clone https://github.com/SiriusScan/Sirius.git cd Sirius docker compose -f...

Decepticon v1.1.40

Decepticon — Autonomous Red Team Agent "Another AI hacker? Let us guess — it runs nmap and writes a report." ☁️ Don't want to self-host? Decepticon is live in the cloud. Skip the Docker setup — run autonomous red-team engagements right from your browser. !Launch the live app at app.decept...

monitor v0.31.0

BetterDB Monitor The monitoring layer that Valkey deserves. BetterDB persists what Valkey throws away - slowlogs, command patterns, client activity, anomaly signals - so you can debug what happened at 3am, not just what's happening now. Built for Valkey 8.x with native support for COMMANDLOG,...

CVE-2026-47669 DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

CVE-2026-47669 DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

CVE-2026-34150 Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing complete loss of SI...

Insecure Default Initialization of Resource

Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource through the use of a default APPSECRET value in the Docker deployment process. An attacker can gain unauthorized access to any user account, including administrative accounts, by forging...

zenml-io/zenml does not expire the session after password reset

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the...

PYSEC-2026-2069 zenml-io/zenml does not expire the session after password reset

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the...

CVE-2026-58446 Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication AUTHUSERNAME/AUTHPASSWORD, is reachable unauthenticated at /mcp because the nginx front-end does not apply the authrequest gate to that path and the MCP server auto-mints a...