httpdoom

HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg\ httpdoom.console...

jadx

JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...

mwebfp

LNHG - Massive Web Fingerprinter mwebfp Introduction The "LowNoiseHG LNHG Massive Web Fingerprinter " "mwebfp " from now on was conceived in July 2013 after realizing the usefulness of webserver screenshots to pentesters, during an engagement with large external or internal IP address ranges, as ...

Tarmageddon-CVE-2025-62518-

Tarmageddon CVE-2025-62518 Video: https://youtu.be/EYBB4BHsp9E Repo directories vulnerable-extract minimal repoducible example, takes a path as arg, and extracts that file to ./output malicious-payload creates a simple malicious.tar archive with some example of smuggled content, comments explain...

NPM: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

NPM: Hono: Incomplete fix for CVE-2026-39408: toSSG still writes files outside the output directory vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Details Static site generation builds each output path from the route pat...

JLSEC-2026-1233

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used...

CVE-2026-19281

A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack ...

EUVD-2026-54780

A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack ...

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Summary image.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both t...

CVE-2026-67429

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429

Flyto2 Core (execution kernel for automation/AI-agent workflows) contains an Arbitrary File Write vulnerability in image.download and related file-writing modules prior to version 2.26.6. The root cause is caller-controlled output_dir, which bypasses validate_path_with_env_config and FLYTO_SANDBO...

CVE-2026-54545

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

CVE-2026-54545

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

SUSE CVE-2026-42448

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output " where that output directory currently exists as a directory. This vulnerability is fixed in 0.24.0...

EUVD-2026-44936

Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName...

CVE-2026-45711

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http sub-command downloads every message from a remote Mailpit instance and writes each one as .eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON...