SecureCodingDojo

About the Secure Coding Dojo The Secure Coding Dojo is a platform for delivering secure coding training. While it comes with its own vulnerable training application the Insecure.Inc website the training portal can be used in conjunction with other training applications. The strength of the platfo...

sublert

/ / / / / / / / \ / / / / / / / / / / / // / // / / / / / / //,/.//// / Author: Yassine Aboukir Version: 1.4.7 What's this about? Sublert is a security and reconnaissance tool that was written in Python to leverage certificate transparency for the sole purpose of monitoring new subdomains...

T3SF

T3SF Technical Tabletop Exercises Simulation Framework Table of Contents About Getting Things Ready TODO CHANGELOG Contributing About T3SF is a framework that offers a modular structure for the orchestration of events based on a master scenario events list MSEL together with a set of rules define...

securitybot

Securitybot みんなのための分散アラート！ Securitybot は、Ryan Huber のブログ記事で説明されている分散アラートチャットボットのオープンソース実装です。 分散アラートは、セキュリティチームの監視効率を向上させ、セキュリティインシデントをより迅速かつ効率的に発見するのに役立ちます。 Dropbox 特有の部分はこのコードから取り除くようにしているため、独自のインスタンスをセットアップするのはかなり簡単なはずです。 virtualenv/Docker コンテナに記載された要件をインストールし、ボットを動かすだけで比較的簡単に使えます。...

securitybot

Securitybot Distributed alerting for the masses! Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber's blog post. Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster...

CVE-2026-16910

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

EUVD-2026-48503

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

Slack integration leaks sensitive information in logs

ImpactSentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, it is possible under specific configurations, an attacker can forge request...

PYSEC-2026-1913 Slack integration leaks sensitive information in logs

Impact Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, it is possible under specific configurations, an attacker can forge reques...

PT-2026-52576

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.5.0 Description An issue exists in the IntegrationTemplateProcessor.ReplaceTokens function where user-controlled values are substituted into event-integration templates without proper JSON encoding. An...

CVE-2026-53823

OpenClaw is affected by a privilege-escalation vulnerability in the allowFrom feature, where binding to mutable Slack display names enables an attacker with Slack account access to alter display name metadata to match policy entries and gain unauthorized agent access intended for other identities...

CVE-2026-44695

Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a...

CVE-2026-44695

Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a...

EUVD-2026-29343

Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a...

CVE-2026-44695

Summary: CVE-2026-44695 affects Outline before version 1.7.1. The Slack OAuth flow for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. If an attacker can obtain a Slack OAuth code for the same Outline Slack client, they can cause a logged-in Outline user to comple...

CVE-2026-44695

Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a...

Outline 跨站请求伪造漏洞

Outline is an open-source knowledge base developed by Outline. Versions prior to Outline 1.7.1 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the Slack integration callback accepting unsigned OAuth state values, which could allow third parties to link user...

CVE-2026-44695: Cross-Site Request Forgery (CSRF)

Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a...

PT-2026-39865

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.7.1 Description The Slack integration callback for the endpoint "/auth/slack.post" accepts an unsigned, session-independent OAuth state value. This allows a third party with a Slack OAuth code for the same Outline...

OpenClaw Code Injection Vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a code injection vulnerability. The vulnerability stems from the fact that channel metadata may be included in the model's system prompts when the Slack integration is enabled, increasing the attack...