autochrome

autochrome تقوم هذه الأداة بتنزيل نسخة جديدة لامعة من Chromium وتثبيتها وإعدادها. تتضمن مزايا أنيقة مثل: إيقاف تشغيل كل هذه المحدِّثات التلقائية المزعجة! سمات ملونة أنيقة لرؤية عالية! بدون مدقِّق XSS! إعداد وكيل تلقائي! يستخدم 127.0.0.1:8080 شريط معلومات مزعج لأنه لا يتحقق من شهادات TLS! تكامل...

burpa

burpa: बर्प ऑटोमेटर एक बर्प सूट ऑटोमेशन टूल आवश्यकताएँ burp-rest-api बर्प सूट प्रोफेशनल slackclient उपयोग root@kitploit: $ python burpa.py -h / / / / / / / / / / / // / // / / / // / // / /./,// / ./,/ // burpa version 0.1 / by 0x4D31 usage: burpa.py -h -a scan,proxy-config,stop -pP PROXYPORT...

CVE2026-42926

CVE-2026-42926 مختبر حقن إطارات HTTP/2 في NGINX مختبر أمن سيبراني مُتحكم به للتحقق من السلوك المرتبط بـ CVE-2026-42926 ومقارنته، وهي مشكلة حقن إطارات HTTP/2 تؤثر على إصدارات محددة من NGINX عند استخدام إعداد وكيل proxy قابل للاستغلال. هذا المستودع مخصّص حصريًا لـ البحث الدفاعي، والتحقق من التصحيحا...

cve-2022-22965

Spring4Shell - CVE-2022-22965 Construction clonons le dépôt, compilons et exécutons le conteneur root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22965.git $ cd cve-2022-22965 $ docker build . -t spring4shell-poc $ docker run -p 8080:8080 --name spring4shell-poc spring4shell-poc...

CVE-2022-35914

CVE-2022-35914 أداة الفحص الجماعي قم بإنشاء ملف target.txt، ثم قم باستيراد عناوين URL المراد فحصها، ويمكنك بعد ذلك بدء الفحص الجماعي. إذا ظهر خطأ، يرجى إيقاف تشغيل الوكيل...

EUVD-2026-69568

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...

Astra Linux – Vulnerability in libproxy

In libproxy, the url.cpp module in version 0.4.15 is vulnerable to a buffer overflow when PAC is enabled. This vulnerability was confirmed by using a large PAC file that was sent without a Content-length header...

EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-2962)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one,...

CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...

Linux Distros Unpatched Vulnerability : CVE-2026-12547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via...

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...

MAL-2026-10759 Malicious code in ryry-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts und...

EUVD-2026-44823

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

CVE-2026-63175

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

CVE-2026-63175 Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

CVE-2026-63175 Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

PYSEC-2026-2597 LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

Impact The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following: - Modify proxy configuration and environment variables - Register custom pass-through endpoint handlers pointing to...

PYSEC-2026-1252 Potential access to sensitive URLs via CKAN extensions (SSRF)

Impact There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents e.g. pushing to the DataStore, streaming contents or saving a local...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the process of reusing a handle for sequential transfers with environment-variable proxy configuration. An attacker can cause sensitive authentication headers to be sent to an...

PYSEC-2026-588

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through...