querytool

QUERYTOOL - Google Sheet designed for OSINT About QueryTool is a specialized OSINT framework integrated within Google Sheets, aimed at simplifying the process of generating queries for various search engines to obtain specific results. Designed as an initial step in reconnaissance, QueryTool...

Ominis-OSINT

Ominis-OSINT: Web Hunter Discover online mentions of a query or username, and map the social profiles and forums that surface with them. Ominis searches public web results, reports what it finds, and gets out of the way. MIT licensed. Maintained by AnonCatalyst with the WinterGate Intelligence...

dark-web-osint-tools

🕵️‍♂️ OSINT Tools for the Dark Web 🔎 Dark Web Search Engine Tools Katana - https://github.com/adnane-X-tebbaa/Katana OnionSearch - https://github.com/megadose/OnionSearch Darkdump - https://github.com/josh0xA/darkdump Ahmia Search Engine - ahmia.fi, https://github.com/ahmia/ahmia-site Darkus -...

GeoSentinel

🌍 GeoSentinel GeoSentinel is a geospatial monitoring platform that tracks global movement in real time. It aggregates ship and flight routes, live coordinates, and geodata into a unified system, providing clear geographic and geopolitical awareness for analysis, visualization, and decision-making...

CVE-2017-5638

CVE-2017-5638 Google Dork : "site:com filetype:action"...

Darkus

Darkus is a Onion websites searcher it uses deep/dark web searcher engines to search a specific word and give you back the link results. DISCLAIMER This tool is intented only for research and educational purposes only. I do not assume any liability for any bad/illegal usage of this tool...

GHSA-J8F7-X8JM-WMM4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

AgentDoxx: Agentic Re-Identification of Anonymized Text with Web Search

As Large Language Models LLMs gain tool use capabilities such as web search, they can retrieve and cross-reference public information, creating privacy risks beyond memorization. One manifestation is re-identification: linking an anonymized interview transcript to a named individual. Yet without...

CLEANSTART-2024-NN66472 Use after free in Web Search in Google Chrome prior to 98

Security vulnerability affects the chromium package. Use after free in Web Search in Google Chrome prior to 98...

PT-2026-105865

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

Astra Linux – Vulnerability in Chromium

The use of “after free” in web searches in Google Chrome before version 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption through profile destruction...

CVE-2026-87999

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

CVE-2026-87996

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

CVE-2026-87996: Time-of-check Time-of-use (TOCTOU) Race Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

live-copilot-poc

Live Copilot PoC Универсальный live-суфлёр: слушает разговор...

PT-2026-76486

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

Malware in @or-sdk/web-search

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @or-sdk/web-search (npm)

npm/@or-sdk/web-search is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11738 Malicious code in @or-sdk/web-search (npm)

npm/@or-sdk/web-search is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

CVE-2026-70485: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...