tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices. "The...

fire-hd-ownership

fire-hd-ownership Owning the tablet I already bought. In November 2022 I bought a Fire HD 10 11th gen, 2021 model on eBay for $114.26 to be a Home Assistant kiosk. It ran fine for years, then started powering itself off. The logs said why: Amazon's own software was issuing the shutdowns, and the...

confused

Confused Una herramienta para verificar espacios de nombres libres persistentes para nombres de paquetes privados referenciados en la configuración de dependencias para Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json o MVN maven pom.xml. ¿De qué se trata todo...

ore-mal-pkg-inspector

OreWatch Detección de Paquetes Maliciosos Multi-Ecosistema y Escáner de Seguridad en la Cadena de Suministro Una herramienta de seguridad de grado de producción para detectar paquetes maliciosos y amenazas en la cadena de suministro en los ecosistemas npm, PyPI, Maven, RubyGems, Go y Cargo...

CLSA-2026-1788251580 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.5.11-tuxcare.1...

CVE-2025-57389

CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2 Description A reflected cross-site scripting XSS vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint. Proof of Concept 1. While proxying the traffic to Burp, navigate to...

tcconfig

.. contents:: tcconfig :backlinks: top :depth: 2 Summary tcconfig is a tc command wrapper. Make it easy to set up traffic control of network bandwidth/latency/packet-loss/packet-corruption/etc. to a network-interface/Docker-containerveth. |PyPI pkg ver| |Supported Python ver| |CI status| |CodeQL|...

golang-x-text

Go Text This repository holds supplementary Go packages for text processing, many involving Unicode. CLDR Versioning It is important that the Unicode version used in x/text matches the one used by your Go compiler. The x/text repository supports multiple versions of Unicode and will match the...

CLSA-2026-1788216921 TuxCare security update for io.netty (28 CVEs)

TuxCare rebuilt 46 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2...

heaphopper

heaphopper HeapHopper is a bounded model checking framework for Heap-implementations. Overview Setup root@kitploit: sudo apt update && sudo apt install build-essential python3-dev virtualenvwrapper git clone https://github.com/angr/heaphopper.git && cd ./heaphopper mkvirtualenv -ppython3 heaphopp...

GHSA-GJHQ-GJFW-99MQ vulnerabilities

Vulnerabilities for packages: snyk-cli, prometheus-operator, telegraf, kubernetes, cert-manager, kubernetes-dashboard, flux-notification-controller, chisel, helm, containerd, spire-server, nerdctl, kine, skaffold, external-dns, fscrypt, flux-source-controller, rclone, argocd-image-updater, minio,...

GHSA-GJHQ-GJFW-99MQ vulnerabilities

Vulnerabilities for packages: external-dns, rclone, skaffold, kyverno, prometheus-mongodb-exporter, containerd, minio-fips, opentelemetry-collector-k8s, kubevela-fips, nerdctl, k9s-fips, kubevela, skaffold-fips, rancher-agent, kubescape, coder, kubernetes-dashboard, k9s, kube-conformance, flux,...

debian-lenny-bash_3.2.52-cve-2014-6271

debian-lenny-bash3.2.52-cve-2014-6271 Debian Lenny Bash packages with cve-2014-6271 patches i386 and amd64 You can test the flaw by running: env x=' :;; echo vulnerable' bash -c "echo this is a test"...

tanstack-shield

🛡️ tanstack-shield Escáner de ataques a la cadena de suministro con un solo comando para CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx Detecta el gusano "Mini Shai-Hulud" que comprometió 42 paquetes npm @tanstack/ 84 versiones maliciosas el 11 de mayo de 2026. root@kitploit: One line — scan your project...

tanstack-compromise-checker

tanstack-compromise-checker ⚠️ Disclaimer: This tool was built for my own use case. All indicators are derived from the following advisory sources: GHSA-g7cv-rxg3-hmpx Snyk: TanStack npm packages compromised StepSecurity: Mini Shai-Hulud deep dive If new IOCs, payload variants, or attacker...

cisco_asa_research

Cisco ASA Research This repository contains slides and code presented at Black Hat USA 2022 and DEF CON 30. The following can be found: Slides DEF CON 30 and Black Hat slide decks. The DEF CON deck is slightly longer due to a longer time slot. theway - a tool for creating malicious/distributable...

CVE-2026-82653

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2026-82653

SiYuan before v3.8.1 is affected by a stored cross-site scripting (XSS) vulnerability in the confirmDialog() function. Unescaped package names and notebook names are interpolated directly into innerHTML assignments, allowing attackers to submit malicious bazaar packages with HTML/script payloads ...

CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...