25 matches found
xpfarm
XPFarm An open-source vulnerability scanner that wraps well-known open-source security tools behind a single web UI. Index Section| Description ---|--- Why| Motivation and philosophy behind XPFarm Wrapped Tools| The 10 open-source tools orchestrated by XPFarm Architecture Map| Full system...
threatest
Threatest Threatest is a CLI and Go framework for testing threat detection end-to-end. Threatest allows you to detonate an attack technique, and verify that the alert you expect was generated in your favorite security platform. Read the announcement blog post:...
xray
Welcome to xray 👋 A Powerful Security Assessment Tool 🏠 Documentation • ⬇️ Download xray • ⬇️ Download xpoc • ⬇️ Download xapp • 📖 Plugin Repository 中文版 Note: xray is not open source, just download the built binary files directly. The repository mainly contains community-contributed POCs. Each xray...
ehids-agent
English | 中文介绍 Introduction to eHIDS HIDS demo implemented by eBPF kernel technology. Warning Just a eBPF-based DEMO, please use Tetragon / Tracee / falco instead. Implementations & Functionalities： 1. TCP network data capture 2. UDP network data capture 3. DNS information capture in uprobe mode ...
cnitch
cnitch cnitch（スニッチまたはコンテナスニッチ）は、Dockerコンテナを監視し、rootで実行されているプロセスを特定するためのシンプルなフレームワークおよびコマンドラインツールです。 なぜこれが悪いことなのでしょうか？ mhausenblas による「can I haz non-privileged containers?」 をまだご覧になっていないなら、今すぐアクセスして詳細を入手することをお勧めします。 cnitch を開発中に、アプリケーションのバグだと思われる問題に遭遇しました。cnitch が Docker コンテナ内で自身を root...
GOSINT
GOSINT - Open Source Threat Intelligence Gathering and Processing Framework The GOSINT framework is a project used for collecting, processing, and exporting high quality indicators of compromise IOCs. GOSINT allows a security analyst to collect and standardize structured and unstructured threat...
github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy
A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...
threatest v1.5.0
Threatest Threatest is a CLI and Go framework for testing threat detection end-to-end. Threatest allows you to detonate an attack technique, and verify that the alert you expect was generated in your favorite security platform. Read the announcement blog post:...
CLEANSTART-2026-BR58082 Echo is a Go web framework
Multiple security vulnerabilities affect the kube-metrics-adapter package. Echo is a Go web framework. See references for individual vulnerability details...
The vulnerability in the `internal/transport/transport.go` file of the gRPC-Go framework for remote procedure calls in the Go programming language allows a attacker to cause a service failure.
The vulnerability in the internal/transport/transport.go file of the Go-based gRPC-Go framework for remote procedure calls involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...
github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy
A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...
CVE-2026-55484
ALOS HTTP , a Linux-first Go web framework with a custom networking stack, is vulnerable to an unauthenticated remote denial-of-service . The root cause is an unchecked p[0] access in core/utils.go::sanitizeRequestPath after splitPathQuery processes a path beginning with a question mark, leaving ...
go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
...
SUSE CVE-2026-44332
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username...
CVE-2026-44332
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username...
CVE-2026-45045
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add instead of Header.Set when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream serve...
Iris 安全漏洞
Iris is a fast, simple, yet fully functional and highly efficient Go web framework developed under the DFIR-IRIS open source project. Versions of IRIS prior to 2.4.28 contained security vulnerabilities; these vulnerabilities stemmed from the use of the HTTP GET method to alter server state, makin...
PT-2026-21803
Name of the Vulnerable Software and Affected Versions Fiber versions prior to 3.1.0 Description The use of the fiber flash cookie can lead to an unbounded allocation on any server. A specially crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory through unvalidat...
