CVE-2026-112179 MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the las...

WELA

WELA Windows Event Log Analyzer ゑ羅 A tool for auditing Windows event log settings. Created by Yamato Security — make sure you are actually recording the events that matter for DFIR. 📖 Read the Documentation → Available in 15 languages — English · 日本語 · 繁體中文 · 한국어 · Deutsch · Türkçe · Français ·...

PhantomFS

Fake Files. Real Security. Virtual honeypot file system for Windows — lure attackers into a directory that looks real, then catch them in the act. What Is PhantomFS? PhantomFS uses the Windows Projected File System ProjFS to surface a virtual directory full of convincing decoy files — financial...

EUVD-2026-104098

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that...

tgt-monitor-bof

Kerberos TGT Monitoring & Auto-Renewal This repository contains two Async Beacon Object Files BOF. The first, tgt-monitor, monitors the system for Kerberos logon events and wakes up the agent whenever a new Kerberos TGT is captured. Similar to Rubeus' monitor command, this BOF is running...

Royal-Event-Management-System-todate-SQL-Injection-Authenticated

Royal Event Management System - 'todate' SQL Injection Authenticated 1. Description: Royal Event Management System 1.0 allows SQL Injection via parameter 'todate' in /royalevent/btndatesreport.php?= Exploiting this issue could allow an attacker to compromise the application, access or modify data...

cve-2022-46395-qemu

CVE-2022-46395 QEMU r36p0 Lab This repository contains a QEMU/no-Mali lab for reproducing the portable trigger condition of CVE-2022-46395 against the Arm Mali r36p0 driver lineage. The lab is intended for local vulnerability research and regression testing. It does not carry the Pixel-specific...

EventLogin-CVE-2025-29969

EventLogin - CVE-2025-29969 EventLogin is a Time-of-check time-of-use vulnerability in the MS-EVEN protocol. The vulnerability enables low-privileged users to write arbitrary files to a remote machine, effectively bypassing the need for an Administrator account for a remote write. There are two...

ZeroLogon-Exploitation-Check

Script to automate Checks for potential exploitation of CVE-2020-1472 aka ZeroLogon in the domain. This is a very "quick and dirty" script that automates some of the leading artifects in determining an actual exploitation of CVE-2020-1472, compiled from multiple blogs. Ideally, the 2nd check for...

circuit-artist

A Digital Logic Simulation Game Every Circuit Is An Image Game Rules Little pixel triangles are NANDs. Black pixels are background. Everything else is a wire. Screenshots 👀 | | !https://raw.githubusercontent.com/lets-all...

SharpWMI

SharpWMI SharpWMI is a C implementation of various WMI functionality. This includes local/remote WMI queries, remote WMI process creation through win32process, and remote execution of arbitrary VBS through WMI event subscriptions. Alternate credentials are also supported for remote methods...

Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...

PT-2026-117634

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

logira

logira OS-level runtime auditing for unpredictable automation. logira is an observe-only Linux CLI that records runtime exec, file, and net events via eBPF. It helps you see what actually happened during AI agent runs and other forms of automation, with per-run local storage for auditing, post-ru...

Nethive-Project

Nethive-Project Zero to Low Latency Monitoring System Features • Installation • Quick Start • Contributors • User Guide The Nethive Project provides a Security Information and Event Management SIEM insfrastructure empowered by CVSS automatic measurements. Features Machine Learning powered SQL...

T3SF

T3SF Technical Tabletop Exercises Simulation Framework Table of Contents About Getting Things Ready TODO CHANGELOG Contributing About T3SF is a framework that offers a modular structure for the orchestration of events based on a master scenario events list MSEL together with a set of rules define...

EUVD-2025-26393

A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user Maintenance by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive...

RsWindowsThingies

RsWindowsThingies Windows Thingies... but in Rust Tools listenmft Watch an entries' values change. listenmft 0.2.0 Matthew Seyer See the differences in MFT attirbues. USAGE: listenmft.exe OPTIONS FLAGS: -h, --help Prints help information -V, --version Prints version information OPTIONS: -d, --deb...

VindicateTool

Vindicate -brightgreen An LLMNR/NBNS/mDNS Spoofing Detection Toolkit for network administrators What is Vindicate? Vindicate is a tool which detects name service spoofing, often used by IT network attackers to steal credentials e.g. Windows Active Directory passwords from users. It's designed to...

latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...