dark-web-osint-tools

🕵️‍♂️ Инструменты OSINT для даркнета 🔎 Инструменты поисковых систем даркнета Katana - https://github.com/adnane-X-tebbaa/Katana OnionSearch - https://github.com/megadose/OnionSearch Darkdump - https://github.com/josh0xA/darkdump Ahmia Search Engine - ahmia.fi, https://github.com/ahmia/ahmia-site...

GeoSentinel

🌍 ГеоСентинел GeoSentinel — это платформа геопространственного мониторинга, которая отслеживает глобальные перемещения в реальном времени. Она агрегирует маршруты самолётов и кораблей, живые координаты и геоданные в единую систему, обеспечивая чёткую географическую и геополитическую осведомлённос...

querytool

QUERYTOOL - Google Sheet conçue pour l'OSINT À propos QueryTool est un framework OSINT spécialisé intégré dans Google Sheets, visant à simplifier le processus de génération de requêtes pour divers moteurs de recherche afin d'obtenir des résultats spécifiques. Conçu comme une première étape de...

Ominis-OSINT

Ominis-OSINT : Chasseur Web 🌐🕵️‍♂️ SURPRISE UPDATE SCHEDULED FOR DEVELOPMENT REPORTÉ. WINTERGATE VA ÉLARGIR CE PROJET Github Actions Visitez actions/workflows et choisissez l'une des 3 options pour essayer Ominis OSINT directement depuis github ! Web Search :...

GHSA-J8F7-X8JM-WMM4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

AgentDoxx: Agentic Re-Identification of Anonymized Text with Web Search

As Large Language Models LLMs gain tool use capabilities such as web search, they can retrieve and cross-reference public information, creating privacy risks beyond memorization. One manifestation is re-identification: linking an anonymized interview transcript to a named individual. Yet without...

CVE-2017-5638

CVE-2017-5638 Google Dork : "site:com filetype:action"...

CLEANSTART-2024-NN66472 Use after free in Web Search in Google Chrome prior to 98

Security vulnerability affects the chromium package. Use after free in Web Search in Google Chrome prior to 98...

PT-2026-105865

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

Astra Linux – Vulnerability in Chromium

The use of “after free” in web searches in Google Chrome before version 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption through profile destruction...

CVE-2026-87996: Time-of-check Time-of-use (TOCTOU) Race Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

live-copilot-poc

Live Copilot PoC Универсальный live-суфлёр: слушает разговор...

PT-2026-76486

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

Malicious code in @or-sdk/web-search (npm)

npm/@or-sdk/web-search is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11738 Malicious code in @or-sdk/web-search (npm)

npm/@or-sdk/web-search is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

PT-2026-67933

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

CVE-2026-70485: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the web search process. An attacker can gain unauthorized access to restricted operations by exploiting misconfigured input paths. Remediation Upgrade openclaw...

EUVD-2026-43538

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks. Attackers can exploit misconfigured input paths to bypass intended authorization controls and execute...

CVE-2026-62198

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks. Attackers can exploit misconfigured input paths to bypass intended authorization controls and execute...