31 matches found
pyFUD
pyFUD 跨平台多客户端 FUD RAT（远程访问木马） 注意： root@kitploit: 该项目正在积极开发中。可能包含一些错误。 警告： root@kitploit: 1. 不要将任何Payload上传到 VirusTotal.com，否则此工具会随着时间失效。 2. VirusTotal 会与反病毒公司共享签名。 3. 再次警告：别做蠢事！ 安装： root@kitploit: 1. git clone https://github.com/machine1337/pyFUD.git 2. python3 server.py （转到第148行，修改IP和端口，然后启动服务器）...
BlackMamba
BlackMamba 命令与控制 什么是 BlackMamba？ Black Mamba 是一个命令与控制（C2）工具，支持同时处理多个连接。它使用 Python 和 Qt 框架开发，具备多种后渗透阶段的功能。 部分功能 多个客户端 实时通信 加密通信 屏幕截图采集 实时视频捕获 锁定客户端鼠标 文件下载与上传 键盘记录器 网页下载器 欢迎贡献 ⚠️ 嘿，在查看图库之前，你需要知道 BlackMamba 是一个开源项目。如果你觉得这个工具好用，并希望添加某些功能、改进代码性能或对 BlackMamba 进行其他优化，提交 Pull Request 是最好的方式 3 图库...
CVE-2026-47843
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...
EUVD-2026-66678
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...
[SECURITY] Fedora 44 Update: gpsd-3.27.5-5.fc44
gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications such as...
PT-2026-60666
Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enable tasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...
PYSEC-2026-1586 Lollms has an Improper Access Control vulnerability
A vulnerability in the lollmsgenerationevents.py component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The addevents function registers event handlers such as generatetext, cancelgeneration, generatemsg, and generatemsgfrom without implementing...
PT-2026-53226
Name of the Vulnerable Software and Affected Versions MCP Python SDK versions prior to 1.27.2 Description A missing authorization issue exists in the official Model Context Protocol Python SDK. On multi-client servers, the default request handlers registered by the experimental enable tasks helpe...
CVE-2026-30949
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp authorized party claim of Keycloak access tokens against the configured client-id. A valid acces...
EUVD-2026-10868
Parse Server missing audience validation in Keycloak authentication adapter...
EUVD-2026-10869
Parse Server missing audience validation in Keycloak authentication adapter...
GHSA-48MH-J4P5-7J9V Parse Server missing audience validation in Keycloak authentication adapter
Impact The Keycloak authentication adapter does not validate the azp authorized party claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse...
CVE-2026-30949 Parse Server is missing audience validation in Keycloak authentication adapter
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp authorized party claim of Keycloak access tokens against the configured client-id. A valid acces...
CVE-2026-30949 Parse Server is missing audience validation in Keycloak authentication adapter
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp authorized party claim of Keycloak access tokens against the configured client-id. A valid acces...
CVE-2026-30949
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp authorized party claim of Keycloak access tokens against the configured client-id. A valid acces...
PT-2026-24427
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.5 Parse Server versions prior to 8.6.18 Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a flaw in its Keycloak authentication adapter. Specifically, th...
PT-2026-5648
Name of the Vulnerable Software and Affected Versions parisneo/lollms version 5.9.0 Description A flaw exists in the lollms generation events.py component that permits unauthenticated access to sensitive Socket.IO events. The add events function registers event handlers – generate text, cancel...
[SECURITY] Fedora 43 Update: gpsd-3.26.1-6.fc43
gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications such as...