huskyCI

This article can also be read inBrazilian Portuguese. Introduction huskyCI is an open source tool that orchestrates security tests and centralizes all results into a database for further analysis and metrics. It can perform static security analysis in Python Bandit and Safety, Ruby Brakeman,...

httpx

...

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

DivideAndScan

DivideEt Impera And Scan and also merge the scan results Featured Projects...

domhttpx

domhttpx is a google search engine dorker with HTTP toolkit built with python, can make it easier for you to find many URLs/IPs at once with fast time. List Install Usage Flags Basic Usage One Keyword Multiple Keyword Extract Title Page Extract Title Page from Real Path Extract Status Code Extrac...

Scrummage

Scrummage VERSION 3.9 Improved dependency management migration to Poetry Stricter type checking of variables. Improved anonymity of the configuration file via encryption. Manual editing of configuration file is now difficult and it's advised to not edit the configuration file manually. Code quali...

ios-malicious-bithunter

iOS Malicious Bit Hunter Abstract iOS Malicious Bit Hunter is a malicious plug-in detection engine for iOS applications. It can analyze the head of the macho file of the injected dylib dynamic library based on runtime, and can perform behavior analysis through interface input characteristics to...

gf

gf A wrapper around grep to avoid typing common patterns. What? Why? I use grep a lot. When auditing code bases, looking at the output of meg, or just generally dealing with large amounts of data. I often end up using fairly complex patterns like this one: root@kitploit: ▶ grep -HnrE...

ffufPostprocessing

Ffuf: 後処理 残念ながら、ffuf は「-ac」フラグにもかかわらず、無関係なエントリを大量に生成する傾向があります。そのため、これらのエントリをフィルタリングするための後処理ツールを作成しました。 さらに、「-ac」を使用すると、関連するエントリが多く削除されるのを確認しました。特に ffuf が json や xml ファイルに遭遇した場合、「-ac」はそれらを完全に削除する可能性があります。 このツールは ffuf が完了した後に実行する必要があります。また、最初の ffuf コマンドは以下のフラグを指定して実行する必要があります: root@kitploit: -o...

reverie

reverie Automated Pentest Tools Designed For Parrot Linux this tool will make your basic pentesting task like Information Gathering, Security Auditing, And Reporting so this tool will do every task fully automatic. Usage Guide Download / Clone git clone https://github.com/baguswiratmaadi/reverie ...

CVE-2026-97990

In the Linux kernel, the following vulnerability has been resolved: vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a sizet length to receivefilter and...

CVE-2026-97990

The Linux kernel is vulnerable in the vdpa_sim_net component due to an improper check of the vringh_iov_pull_iotlb() return value. Because the function returns a signed byte count, a failed TX pull results in a negative error that is incorrectly added to an unsigned byte counter. This value is th...

cve-2026-59827-metabase-cyber-range

CVE-2026-59827 — Metabase / H2 安全でないデシリアライゼーション サイバーレンジ 教育用ラボ — CVE-2026-59827 GHSA-w95f-x9v9-wv36 をモデル化: Metabase における型 OTHER の H2 クエリ結果カラムの安全でないデシリアライゼーション。 トレーニング専用 — インターネットに公開しないでください クイックスタート root@kitploit: git clone https://github.com/shivammittal2403/cve-2026-59827-metabase-cyber-range.gi...

CVE-2020-24750

CVE-2020-24750 結果：...

CVE-2026-84720

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestorartifacts database column, which stores the raw merged setstats artifacts propagated between workflow nodes, is not wrapped in preventsearch and is therefore accepted for arbitrary field lookups...

EUVD-2026-85521

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...

CVE-2026-81339

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...

CVE-2026-81339 MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...

CVE-2026-81339

The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to perform a per-object ownership check when returning quiz attempt results. This allows any authenticated user with at least a minimal subscriber role to ...

upb-any-recursion-audit

upb Any再帰監査（Ruby / PHPバインディング） protobufのPythonおよびJavaScriptバインディングで確認されたAnyアンラップ再帰CVE（直近ではCVE-2026-0994、jsonformat.pyのConvertAnyMessageにおける純粋なPythonのバグで、ConvertMessageではなくmethodcallerを介して再帰し、深さカウンタを暗黙にスキップしていた）のフォローアップ。 疑問: RubyおよびPHPネイティブ拡張にバンドルされているC upbコアにも同じバグクラスが存在するか？ 短い答え: いいえ。...