CVE-2026-82725

CVE-2026-82725 affects ash_phoenix (versions 0.6.0-rc.1 through before 2.3.25 ) in the AshPhoenix.FilterForm component. The root cause is that the form resolved user-supplied relationship paths with Ash.Resource.Info.related/2 , which traverses private relationships, while only checking the termi...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

CVE-2023-52709-PoC

CVE 2023-52709 "TI蓝牙协议栈无法生成可解析随机私有地址（RPA），导致已绑定对等设备服务中断" 的概念验证 CVE 2023-52709 摘要 在对待测设备（DUT）配置为可解析私有地址并运行Defensics测试用例SMP legacy 1001（循环模式）时，一段时间后设备会生成无法解析的随机私有地址，导致已绑定对等设备发生拒绝服务。 该潜在漏洞可能影响运行受影响SDK版本并启用了蓝牙隐私功能（使用可解析私有地址特性）的低功耗蓝牙设备。 本仓库中的脚本（cve-2023-52709.py）模拟了Defensics测试用例 1001 和 3 的攻击序列 重要函数...

ed25519-unsafe-libs

ed25519-unsafe-libs Ataque de oráculo a la función de firma con doble clave pública sobre Ed25519 Una lista de librerías de firmas ed25519 potencialmente inseguras que permiten una api pública donde la clave secreta y la clave pública pueden proporcionarse de forma independiente como entradas de ...

secret-regex-list

Secret Regex List List of regex for scraping secret API keys and juicy information. You can directly copy this and put into your python code, some regexes might require three quotes or else it will break the code. root@kitploit: "Cloudinary" : "cloudinary://.", "Firebase URL": ".firebaseio.com",...

CVE-2025-54352

CVE-2025-54352 PoC 使用方法 安装并测试 WordPress PoC 的步骤： 1. 使用 Docker 安装一个全新的 WordPress 版本： 1.1 启动 MySQL 数据库容器： root@kitploit: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e MYSQLROOTPASSWORD=rootpass -d mysql:5.7 1.2 启动与数据库链接的 WordPress 容器： root@kitploit:...

CVE-2026-82638

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

CVE-2022-2274

OpenSSL-src 在 RSA 私钥操作时发生堆内存损坏：CVE-2022-2274 摘要 OpenSSL-src-rust 是一个使用 Rust 编写的、以 crate 形式打包的 OpenSSL 源码和从源码构建 OpenSSL 的逻辑。目前有两个受维护的分支，分别对应两个受维护的 OpenSSL 版本，即构建 OpenSSL 3.0 的 main 分支和构建 OpenSSL 1.1.1 的 release/111 分支。 OpenSSL 3.0.4 版本在为支持 AVX512IFMA 指令的 X8664 CPU 实现的 RSA 代码中引入了一个严重缺陷。该问题使得 2048...

CVE-2026-82638 jina-ai reader Server-Side Request Forgery via disabled private-address guard

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

EUVD-2026-68214

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

CVE-2026-82638

jina-ai reader disables its private-address guard outside Google Cloud deployments, creating a Server-Side Request Forgery (SSRF) vulnerability. The root cause lies in conditional logic (referenced in src/services/misc.ts) that only enforces the guard on GCP, leaving other environments exposed. A...

walletool

walletool 一个用于读取 wallet.dat 文件的工具 一个用于从 wallet.dat 文件中提取加密货币钱包数据的实用工具。 在 Windows 或 macOS 上设置该软件， Windows 还是 Linux？请参阅下面的手册。macOS？请使用 DMG 文件。 确保 Windows 上已安装 Git 和 Python。 适用于 Windows 的 Git：https://git-scm.com/install/windows 适用于 Windows 的...

ecdsa-private-key-recovery

ecdsa-key-recovery Execute ataques de recuperação de chave privada por reutilização de nonce em ECDSA e DSA Uma ferramenta de pesquisa criptográfica para analisar vulnerabilidades em assinaturas Vamos recuperar a chave privada de duas assinaturas que compartilham o mesmo nonce k. Observe como...

walletool

walletool uno strumento per leggere i file wallet.dat Un'utilità per estrarre dati di portafogli di criptovalute dai file wallet.dat. Installazione Installare Python 3.x. Installare il modulo bsddb3 se sei su Windows, usa il sito di Gohlke. Estrazione delle chiavi private dai portafogli...

PT-2026-83558

Name of the Vulnerable Software and Affected Versions jina-ai reader affected versions not specified Description The software disables its private-address guard when deployed outside of Google Cloud environments, which enables unauthenticated attackers to perform server-side request forgery SSRF...

CVE-2019-14222

CVE-2019-14222: Standardzertifikat in Alfresco Community Alfresco Community 5.x und darunter wird standardmäßig mit einem Satz bekannter privater Zertifikate ausgeliefert. Jeder, der die Alfresco Community-Software auf einem lokalen Rechner herunterlädt und installiert, erhält Zugriff auf diese...

EUVD-2026-67957

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-19294

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-19294

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-19294

IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by an improper authorization flaw (CWE-639). Deprecated build endpoints remain fully routed but lack the object-level ownership check present on the modern equivalent endpoint, allowing any authenticated user to enumerate and execute ano...