sift

SIFT 这是一个元数据仓库，主要用于讨论和问题追踪。 cast -- 安装 CLI saltstack -- 实际执行安装的状态文件 packer -- 使用上述工具构建机器镜像 package-scripts -- 构建托管在 SIFT PPA 中的某些软件包 支持的发行版 20.04 Ubuntu Focal 22.04 Ubuntu Jammy 安装 Cast 是 SIFT CLI 的替代品。虽然 SIFT CLI 应能继续使用，但它已于 2023 年 3 月 1 日正式弃用，之后不再保证可用。 您必须首先安装 CLI 工具，然后才能安装 SIFT。 sudo cast...

sift

Sift Secrets 面向文件共享的凭据与敏感数据暴露分类排查工具。 当出现一个开放共享时，问题从来不是“这个仓库里有没有泄露的密钥”，而是 “刚刚暴露了什么，我必须在今天下班前轮换哪些密钥。” sift 正是为这个问题而生：高召回率、快速的审查队列，以及一个反馈循环，让你肉眼发现的任何内容都能成为一条规则，进而找到另外两百份副本。 Python 3.11+，仅使用标准库。无需 pip 安装，无需联网，无需构建步骤。它运行在一台锁定加固的事件响应笔记本电脑上，而这正是你需要它的地方。bash sift survey \fileserver\openshare how big is...

sift-kg

sift-kg 将任何文档集合转化为知识图谱。 无需代码，无需数据库，无需基础设施——只需要一个命令行工具和你的文档。放入PDF、论文、文章或记录——几分钟内即可获得一个可浏览的知识图谱，展示所有内容之间的关联。sift-kg通过LLM提取实体和关系，经你确认后去重，并生成一个交互式查看器，你可以在浏览器中探索。任何内容的概念图，唾手可得。 支撑你可视化的同一个图谱也可以作为AI第二大脑。每个人都在Notion和Obsidian上花费数月构建知识库。谁有那个时间？sift-kg是你用2分钟而不是2年构建的结构化记忆。只需指向你的文档，你的AI就能结构化地理解所有内容之间的关联。 现场演示...

CVE-2026-55094

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

EUVD-2026-90208

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094

Taskcluster, a task execution framework used by Mozilla, is vulnerable to unauthenticated remote code execution (RCE) in versions prior to 100.3.0 . The vulnerability exists in the web-server component when an anonymous role is present that exposes the GraphQL endpoint . Specifically, the applica...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

sift-hardened

sift-hardened 作为 sift 17.1.3 的直接替代品，用于修复 CVE-2026-85625。 与 crcn/sift.js 无关联。 相对 17.1.3 的变更 查询键通过 Object.keys（仅自有属性）枚举，因此被污染的 Object.prototype.$where 不会被当作运算符处理。 字符串类型的 $where 值会被拒绝。函数类型的 $where 仍然可用。 安装（npm 别名） "overrides": "sift": "github:lgranadoi/sift-hardened17.1.4"...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625: Improperly Controlled Modification of Object Prototype Attributes

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-28676

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file...

CVE-2026-28677

OpenSift prior to v1.6.3-alpha exposed an SSRF vulnerability in the URL ingest pipeline due to incomplete destination restrictions on user-controlled URLs. In non-localhost deployments, credentialed URLs, non-standard ports, and cross-host redirects created abuse paths. The issue has been patched...

CVE-2026-28676 OpenSift: Insufficient path containment checks in storage helpers could allow path traversal-style file operations

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file...

CVE-2026-27189

OpenSift: A race-prone local persistence issue in versions ≤ 1.1.2-alpha due to non-atomic and insufficiently synchronized JSON persistence flows. This can cause concurrent operations to lose updates or corrupt local state across sessions (study/quiz/flashcard/wellness/auth stores). The vulnerabi...

EUVD-2008-0679

Malware in sbrugna...

CVE-2008-0669

Cross-site scripting XSS vulnerability in search.cgi in Sift Unity allows remote attackers to inject arbitrary web script or HTML via the qt parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...