cervantes

Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients, vulnerabilities, and reports in a single, centralized location. By facilitating efficient data...

CVE-2026-61738

Prior to version 0.1.77 , SOCFortress CoPilot is vulnerable to a path traversal flaw in the POST /api/scoutsuite/generate-gcp-report endpoint. The application takes the raw file.filename from the multipart header and passes it to save_file_to_directory without sanitization. Because os.path.join i...

CVE-2026-61738 SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py admits admin and analyst users and validates the uploaded content as...

mesh-kridik

mesh-kridik Enhance your Kubernetes service mesh security !! mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report The security checks tests are the full implementation of istio security...

infernal-twin

Infernal-Wireless v3 Release 3 Improved and Compatibility on Kali Linux 2018 Added Visual Representation of Wireless Scan Added Visual Representation of Probe Requests and Map per SSID requested by Devices Updated MAC address mapping Added MAC address mappting on probe request devices Evil Twin...

CVE-2026-61730

The SOCFortress CoPilot application suffers from an unauthenticated exposure of sensitive data via a static mount in backend/copilot.py. The /scoutsuite-report endpoint lacks the JWT authentication required by other routes, exposing the scoutsuite-report directory. This allows anonymous clients t...

CVE-2026-61730 SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated /scoutsuite-report StaticFiles mount in backend/copilot.py exposes the scoutsuite-report directory even though normal /api routes require JWT...

EUVD-2026-113995

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated /scoutsuite-report StaticFiles mount in backend/copilot.py exposes the scoutsuite-report directory even though normal /api routes require JWT...

CVE-2026-61730 SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated /scoutsuite-report StaticFiles mount in backend/copilot.py exposes the scoutsuite-report directory even though normal /api routes require JWT...

CVE-2026-61708 SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, POST /api/agentdatastore/upload in backend/app/datastore/datastoreroutes.py permits customeruser callers to choose bucketname and objectname without an allowlist, tenant prefix...

Serverless-Top-10-Project

This is the markdown version of the OWASP Top 10 - Serverless Interpretation report...

CVE-2026-119646

The Open Web Analytics software before version 1.14.1 contains an authorization vulnerability in its REST Report API . The root cause is that clickstream and transaction reports are not properly scoped to the authorized siteId . Consequently, an authenticated user with view_reports permissions on...

CVE-2026-119646 Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

EUVD-2026-114062

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

CVE-2026-119646 Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

threatspec

threatspec - continuous threat modeling, through code Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write...

StickyExim

StickyExim An Email HoneyPot Features Easy to deploy. The install scripts does all the work. Abuse report are atomaticlly created and sent to the attacking IP owner. Abuse reports are stored with a hash at time of creation incase needed later. Requirements Domain names. One real domain you use fo...

ParsingPeas

ParsingPeas 🥒 Automated PEASS collection + a clean, portable HTML report for CTF & lab privilege-escalation work. Run one command on the target. ParsingPeas pulls LinPEAS/WinPEAS from your Kali host, runs the scan, ships the output back, and turns it into a single self-contained HTML report you c...

vthunting

VT Hunting VThunting is now featured on VirusTotal. Virus Total Hunting is a tiny tool based on the VT api version 3 to run daily, weekly or monthly report about malware hunting. The report can be send via email, Slack channel or Telegram. The tool can also be used in cli to get a report anytime...

lunar

LUNAR Lockdown UNix Auditing and Reporting Version Current version 16.6.1 Refer to lunar.sh and CHANGELOG.md for more up to date version information License CC BY-NC-SA: https://creativecommons.org/licenses/by-nc-sa/4.0/ Fund me here: https://ko-fi.com/richardatlateralblast NOTICE Run this code i...