DotGit

DotGit 一个用于检查访问的网站中是否暴露了 .git 文件夹的扩展 功能 检查每个访问的网站是否存在 .git/.svn/.hg 文件夹 检查每个访问的网站是否存在 .env 文件 检查每个访问的网站是否存在 .DSStore 文件 检查网站是否为开源项目（github/gitlab） 检查网站是否有 security.txt 当找到文件夹时会收到通知 列出已发现的暴露站点 以 zip 格式下载整个 .git 文件夹，即使文件未在网站上列出 一键查看 .git/config 选项：颜色、通知和下载 某些检查默认关闭，打开设置以开启它们 下载工作原理 下载有一个队列，具有最大并发连接...

CVE-2026-86486

In JetBrains YouTrack versions before 2026.2.18634 , the generic VCS webhook handler had a fail-open condition when its secret was blank, meaning the handler would not properly validate incoming webhook requests if no secret had been configured. This results in a low integrity impact with a high ...

EUVD-2026-72502

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...

composer-CVE-2026-40261-CVE-2026-40176-PoC

!CAUTION ESTE REPOSITORIO CONTIENE CÓDIGO DE PRUEBA DE CONCEPTO PARA LAS VULNERABILIDADES CVE-2026-40261 Y CVE-2026-40176 EN COMPOSER. !CAUTION EL CÓDIGO ESTÁ DESTINADO ÚNICAMENTE CON FINES EDUCATIVOS Y DE PRUEBA. !CAUTION NO UTILICE ESTE CÓDIGO EN ENTORNOS DE PRODUCCIÓN NI CONTRA SISTEMAS SIN LA...

Exploit for CVE-2026-84361

CVE-2026-84361: Composer’s P4PORT command execution PoC Engl...

JFrog Artifactory 7.161.x < 7.161.19 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.161.x prior to 7.161.19. It is, therefore, affected by multiple vulnerabilities, including: - A user who can read an existing remote VCS repository can replace its configured origin o...

JFrog Artifactory 7.146.x < 7.146.36 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.146.x prior to 7.146.36. It is, therefore, affected by multiple vulnerabilities: - A user who can read an existing remote VCS repository can replace its configured origin or supply an...

CVE-2026-77573

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-77573

Weblate , a web-based continuous localization platform, is affected by a server-side request forgery (SSRF) vulnerability in versions prior to 2026.8 . A user with permission to manage component repository URLs can exploit DNS rebinding during VCS operations: Weblate validates the first DNS resol...

EUVD-2026-66721

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-77573 Weblate: DNS rebinding in VCS operations allows server-side request forgery

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-70551

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

EUVD-2026-65518

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

CVE-2026-70551

CVE-2026-70551 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory via VCS remote download. A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL , redirecting the server's request to an attacker-controlle...

CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

PT-2026-81333

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.161.19 JFrog Artifactory versions prior to 7.146.36 Description An authenticated user with permissions to read an existing remote Version Control System VCS repository can trigger server-side requests. Thi...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: vcscreen: The load of the struct vcdata pointer in vcswrite was reloaded to avoid a Use-After-Free UAF condition. After a call to consoleunlock in vcswrite, the struct vcdata structure can be freed using vcportdestruct. Therefore...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A use-after-free flaw was discovered in vcsread in drivers/tty/vt/vc-screen.c within vc-screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for the PHP programming language. Integrators who use Composer code to call VcsDriver::getFileContent may encounter a code injection vulnerability if the user can control the $file or $identifier arguments. This vulnerability is documented on packagist.org, where...

Astra Linux – Vulnerability in python-pip

When installing a package from a Mercurial VCS URL e.g., “pip install hg+…” using pip before version 23.3, the specified Mercurial revision could be used to inject arbitrary configuration options into the “hg clone” call e.g., “--config”. Controlling the Mercurial configuration allows modifying t...