toothpicker

ToothPicker ToothPicker is an in-process, coverage-guided fuzzer for iOS. It was developed to specifically targets iOS's Bluetooth daemon bluetoothd and to analyze various Bluetooth protocols on iOS. As it is built using FRIDA, it can be adapted to target any platform that runs FRIDA. This...

zettelforge

ZettelForge The only agentic memory system built for cyber threat intelligence. When a senior analyst leaves, two or three years of context walks out with them — customer environments, prior investigations, actor TTPs, false-positive patterns, every hard-won "wait, we've seen this before."...

fpicker

fpicker fpicker is a Frida-based fuzzing suite that offers a variety of fuzzing modes for in-process fuzzing, such as an AFL++ mode or a passive tracing mode. It should run on all platforms that are supported by Frida. Installation Instructions Building and Running Creating a Fuzzing Harness Mode...

lfi

Lightweight Fault Isolation LFI Welcome to the top-level repository for the Lightweight Fault Isolation LFI project. What is LFI? LFI is a system for sandboxing native code. Like WebAssembly and Native Client, LFI isolates sandboxed code in-process i.e., in the same address space as a host...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any...

apatchy

apatchy An in-process fuzzing framework for Apache HTTPD apatchy lets you fuzz Apache's full HTTP request processing pipeline - parsing, hooks, filters, handlers - without any network I/O. It replaces Apache's socket layer with custom I/O filters, feeding raw bytes directly into the same code pat...

ubertooth

Ubertooth Project Ubertooth is an open source wireless development platform suitable for Bluetooth experimentation. Ubertooth ships with a capable BLE Bluetooth Smart sniffer and can sniff some data from Basic Rate BR Bluetooth Classic connections. The latest release is 2020-12-R1. The latest...

EUVD-2026-79765

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Workbenches. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardwa...

CVE-2026-83477

Oracle E-Business Suite (component: Work in Process – Workbenches ) is affected by an easily exploitable vulnerability in supported versions 12.2.3 through 12.2.15 . An unauthenticated attacker with access to the adjacent network segment can compromise the product with low complexity and no user ...

CVE-2026-83477: Improper Access Control

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Workbenches. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardwa...

PT-2026-92933

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Workbenches. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardwa...

CVE-2026-55235

langgraph-api (the LangGraph Server runtime) prior to 0.10.0 allows a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport. The authentication middleware treats this transport as internal, so the webhook reaches the server's own thread and ru...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-76059

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by a protection mechanism failure (CWE-693) in its static code security scanner. An attacker who can submit custom component source code can bypass the scanner by crafting an annotated class-body assignment that resolves to a dangerous c...

PYSEC-2026-3857 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

Summary In affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...

langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

SummaryIn affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...

PT-2026-89610

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A logic error in the static security scanner allows an attacker to bypass security checks by crafting an annotated class-body assignment. This technique uses alias tracking to resolve ...

vm2 v3.11.8

vm2 !NPM Versionnpm-imagenpm-url !NPM Downloadsdownloads-imagedownloads-url !Licenselicense-imagelicense-url !Known Vulnerabilitiessnyk-imagesnyk-url vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Installation npm install vm2 Quick Examples import VM from...

GHSA-2C9Q-C2Q9-QGQV langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

Summary In affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...