app

Standard Notes Standard Notes هو تطبيق لتدوين الملاحظات مشفّر من الطرف إلى الطرف للمهتمين بالرقمنة والمحترفين. التقط ملاحظاتك وملفاتك وعمل حياتك كلها في مكان واحد آمن. لماذا Standard Notes؟ مزامنة مشفّرة من الطرف إلى الطرف. أنت فقط من يستطيع قراءة ملاحظاتك. مزامنة سريعة ومجانية ومشفّرة عبر المنصا...

pwndrop

pwndrop एक स्व-परिनियोज्य फ़ाइल होस्टिंग सेवा है जो रेड टीमिंग पेलोड भेजने या आपकी निजी फ़ाइलों को HTTP और WebDAV पर सुरक्षित रूप से साझा करने के लिए है। यदि आपको कभी भी अपनी फ़ाइलों को होस्ट करने के लिए जल्दी से nginx/apache वेब सर्वर सेट अप करने की आवश्यकता हुई है और आप python -m SimpleHTTPServ...

domain-locker

Domain Locker The Central Hub for all your Domain Names 🌐domain-locker.com Contents About Screenshot Features Live Demo Get Started Domain-Locker.com Self-Hosting Developing App Setup Architecture Contributing Attributions License About The aim of Domain Locker, is to give you complete visibility...

bore

bore A modern, simple TCP tunnel in Rust that exposes local ports to a remote server, bypassing standard NAT connection firewalls. That's all it does: no more, and no less. root@kitploit: Installation requires Rust, see alternatives below cargo install bore-cli On your local machine bore local 80...

authentik

ما هو authentik؟ authentik هو مزوّد هوية IdP مفتوح المصدر للدخول الموحّد SSO الحديث. يدعم SAML وOAuth2/OIDC وLDAP وRADIUS والمزيد، وهو مصمَّم للاستضافة الذاتية من المختبرات الصغيرة إلى مجموعات الإنتاج الكبيرة. عرضنا المخصّص للمؤسسات متاح للمنظمات لاستبدال مزوّدي الهوية الحاليين مثل Okta وAuth0...

interactsh

An OOB interaction gathering server and client library Features • Usage • • • •...

zdr

Zero Data Retention ZDR for LLM Providers Last updated: April 2026 A practical guide to keeping your data private when using LLM APIs. Covers zero-retention endpoints, self-hosting, compliance requirements, and data protection patterns for engineers in regulated industries. Table of Contents Whic...

allstar v4.6

Allstar !IMPORTANT The OpenSSF-hosted Allstar GitHub App has been retired. Allstar, the OpenSSF Scorecard subproject, itself continues to be maintained — you must now run it yourself, either as a GitHub Action or as a service daemon. See ossf/allstar881 for more details. If your organization was...

Next.js: Next.js: Denial of Service via Image Optimization API

A flaw was found in Next.js. When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. A remote attacker could exploit this by requesting large local assets from the /next/image endpoint...

CVE-2026-64644

A flaw was found in Next.js, a React framework. When self-hosting Next.js with the default image loader and configured to optimize remotely hosted images, a remote attacker could exploit the Image Optimization API. By providing malicious images, the attacker can cause CPU exhaustion, leading to a...

EUVD-2026-49388

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...

CVE-2026-64644 Next.js: Denial of Service in the Image Optimization API using SVGs

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...

CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could...

CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could...

CVE-2025-23214

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out whether a user exist or not in the database. Patched in 0.17.7...

EUVD-2025-26598

Malicious code in bioql PyPI...

EUVD-2025-23660

Malicious code in bioql PyPI...

CVE-2025-58351 Outline's Local File Storage Feature can Cause CSP Bypass

Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that...

CVE-2025-58351 Outline's Local File Storage Feature can Cause CSP Bypass

Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that...

PT-2025-35656

Name of the Vulnerable Software and Affected Versions: Outline versions 0.72.0 through 0.83.0 Description: Outline, a collaborative documentation service, introduced a local file system storage feature in versions 0.72.0 through 0.83.0. This feature introduced a Content-Type bypass and a Cross-Si...