darkgrid

DarkGrid – Global Threat Intelligence Dashboard OSINT threat‑intel dashboard: a 3D globe and live feed showing malicious infrastructure from public sources like AbuseIPDB and OpenPhish. https://github.com/user-attachments/assets/e4f6a4fa-6ff4-4ad1-8e5c-5b50ce6ad722 Overview DarkGrid visualizes...

cygor

Cygor General Overview Cygor is a modular asset discovery framework that brings scanning, parsing, and service enumeration together in one workflow. It replaces the patchwork of separate tools with an automated process that handles discovery, enrichment, and targeted enumeration seamlessly —...

Reconator

Reconator is an automated reconnaissance framework. Add a target — alone or in bulk — and the worker runs 17 recon modules against it subdomain enum, dirbrute, JS/link mining, WAF fingerprint, takeover check, GF triage, and more. The dashboard shows per-module output as it lands. Stack Layer| Tec...

ZeroPulse

ZeroPulse A Modern Command & Control C2 Platform with Cloudflare Tunnel Integration CodeFactor 📋 Table of Contents Overview Features Architecture Prerequisites Installation Configuration Usage API Documentation Security Project Structure Development Contributing License Acknowledgments Support 🎯...

DeepAudit

DeepAudit - Your AI Security Audit Team, Making Vulnerability Discovery Accessible 简体中文 | English Screenshots Agent Audit Entry Quick access to Multi-Agent deep audit from the homepage Audit Flow Logs !Audit Flow...

grubcrawler

Agentic web crawler with anti-detection, vision fallback, and peer-to-peer mesh. Endpoints · Mesh · Anti-Detection · Ghost Protocol · Live Stream · MCP Tools · Quick Start · Benchmarks · Architecture Full-stack web crawling engine with JavaScript rendering, Camoufox anti-detect browser, per-reque...

iKy

Description | Installation | Website | Modules | Issues | Supporting iKy Description iKy is an OSINT tool that collects information from an email address or other selectors and displays the results in a visual interface. pending update: reflects the previous frontend Video Demo Installation...

Recon-Scan

Recon-Scan ReconScan is a open-source passive recon scanner with a FastAPI backend, async worker pipeline, and a single-page frontend. You can check the deployed site at https://recon-scan.vercel.app/ The point is fast signal: run a scan, get module-by-module findings, and get an AI summary that...

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. Installation With...

PCLink

PCLink Server The secure backbone for your personal PC remote control ecosystem. PCLink is a modern, web-first server designed for secure remote PC management and high-performance screen streaming. Featuring a high-performance FastAPI backend, a responsive Web UI, and an extensible plugin system...

damn-vulnerable-MCP-server

Compatibilidad SSE de Cursor para Damn Vulnerable MCP Este documento proporciona una visión general de las actualizaciones realizadas en el proyecto Damn Vulnerable Model Context Protocol DVMCP para hacerlo compatible con la implementación de Server-Sent Events SSE de Cursor. Resumen El proyecto...

enforcement-coverage

Cobertura de Cumplimiento Encuentra rutas de API que llevan un control de autorización más débil que el de sus rutas hermanas. Encontró CVE-2026-45316 en Open WebUI solo a partir del código fuente, sin conocimiento de avisos de seguridad: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3...

BadHost-CVE-2026-48710-Exploit

BadHost — CVE-2026-48710 Scanner Detection-only scanner for the BadHost auth-bypass in Starlette / FastAPI — where auth middleware reads request.url.path instead of request.scope"path", allowing a crafted Host header to smuggle an allowlisted path and bypass authentication. GET /admin HTTP/1.1...

CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - Bypass de Autorización en ajaxlookup de SQLAdmin Resumen Ejecutivo Este repositorio contiene un laboratorio Docker local para reproducir CVE-2026-46645, una vulnerabilidad de bypass de autorización que afecta al endpoint ajaxlookup de SQLAdmin. SQLAdmin es una interfaz de...

cve-2026-103956-loom-unauth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cve-2026-103956-loom-unauth cve-2026-103956-loom-unauth Loom for AWS 1.6.1 - AWS Labs When Cognito is unset and no external IdP is active, getcurrentuser hands every request t-admin / g-admins-super. That includes...

briefr

BRIEFR Inteligencia de CVE autoalojada para analistas que necesitan respuestas, no otro feed en bruto Demo en vivo · Documentación · Inicio rápido · Capturas de pantalla ¿Qué es BRIEFR? BRIEFR es un panel de inteligencia de CVE autoalojado. Extrae fuentes públicas de vulnerabilidades y amenazas a...

bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork

CVE-2026-73678 — RCE no autenticado en MindsDB Minds Platform / MindsHub Cowork PoC para CVE-2026-73678 CVSS 3.1 10.0 Crítico , AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Análisis completo: www.hunt-benito.com/blog/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork/ El sidecar...

CVE-2025-23266

CVE-2025-23266 Autor: Mark Mallia Plataforma objetivo: Ubuntu 22.04, FastAPI v2.4.3 → parcheado a v2.5.1 el 2025‑10‑02 1 – En resumen: ¿qué implica este ataque La rutina parserequest de FastAPI copia los encabezados de las solicitudes HTTP en un pequeño búfer que reside en la pila del llamante. S...

SOCMIntelligence

SOCMIntelligence Multi-platform SOCMINT / OSINT web tool. What it is SOCMIntelligence collects public data from many platforms, turns each result into charts, finding tables and a relationship graph , and merges everything into a single cross-platform identity graph. Because the same account gets...