flawfinder

About This is "flawfinder" by David A. Wheeler. Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools...

vimana-framework

Overview Vimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to assess, fuzz, and analyze Python projects through automated and manual techniques. Core Capabilities: Vulnerability detection and...

sandsifter

s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...

malicious-pdf

Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...

fuxploider

fuxploider Fuxploider is an open source penetration testing tool that automates the process of detecting and exploiting file upload forms flaws. This tool is able to detect the file types allowed to be uploaded and is able to detect which technique will work best to upload web shells or any...

graudit

graudit graudit 是一个简单的脚本和签名集，允许您使用 GNU 工具 grep 查找源代码中的潜在安全漏洞。它与其他静态分析应用程序（如 RATS、SWAAT 和 flaw-finder）相当，同时将技术要求降到最低，并且非常灵活。 安装 可以以普通用户或全局 root 身份安装，只需使用 userinstall 或 install 参数运行 make 即可。不过，建议通过克隆 git 仓库直接使用 graudit，因为它包含发行版文件中未包含的额外数据库规则。这还使您能够在新版本发布之间获取更新。为此，请运行以下命令： git clone...

CVE-2026-9198_exploit

CVE-2026-9198 — Langflow OSS RCE no autenticado Ejecución remota de código no autenticada en IBM Langflow OSS 1.0.0 – 1.10.0 en una implementación predeterminada. Encadena dos fallos: CVE-2026-9103 — GET /api/v1/autologin emite un JWT SUPERUSER a cualquier solicitante sin credenciales cuando...

USN-8802-1 linux-oracle, linux-oracle-6.8 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - PowerPC architecture; - Compute Acceleration Framework; - Drivers core;...

Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws

Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a bug in the software that runs OpenAI's public help foru...

Astra Linux – Vulnerability in python-git

All versions of the GitPython package are vulnerable to Remote Code Execution RCE due to improper user input validation. This allows for the injection of a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to...

Astra Linux – Vulnerability in Intel Microcode

Improper isolation of shared resources in some IntelR processors may allow a privileged user to potentially enable information disclosure through local access...

WebGoat v2026.3

WebGoat: A deliberately insecure Web Application Introduction WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. This program is a demonstration of common server-side application flaws. The exercises are intended to be used b...

A week in security (September 7 – September 13)

Here's what we've covered in the last seven days on Malwarebytes Labs: Crypto customers targeted by scammers after email marketing provider breach Android malware creates a hidden copy of your banking app BlueMoon exploit kit turns Chrome and Windows flaws into attacks Will AI kill us all within...

CVE-2026-87637

creationtimestamp| type| source ---|---|--- 2026-09-10 01:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4wrxnbwu2j 2026-09-10 04:45:21+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 05:37:06+00:00| seen|...

ASB-A-397216638

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname CVE-2026-16093: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers CVE-2026-16072: Organization...

CVE-2026-79242

creationtimestamp| type| source ---|---|--- 2026-08-26 05:18:15+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826 2026-08-31 05:17:40+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260831...

CVE-2026-21752 HCL Hive is affected by a use of vulnerable third-party components

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...

CVE-2026-21752

HCL Hive is affected by its use of vulnerable third-party components , which could allow a remote attacker to gain unauthorized access or compromise the system by exploiting publicly documented security flaws. The CVSS 3.1 score is 7.5 (HIGH) , with a High confidentiality impact over a network wi...

EUVD-2026-64917

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...