weakpass

Weakpass 여기서 weakpass.com의 비밀번호 및 해시 크래킹을 위한 도구 목록과 API 서버 예제를 한 곳에서 찾을 수 있습니다. 📂 폴더 구조 tools 비밀번호 및 해시 크래킹 도구 모음입니다. 확인해보세요: Kraker-js Lookup Passcheck Passgen libs 이 프로젝트에서 사용된 라이브러리 링크입니다. rules 고급 공격을 위한 크래킹 규칙 아카이브입니다. 모든 도구와 라이브러리는 별도의 폴더에서 찾을 수 있으며, 지금 바로 사용해보고 싶다면 도구에 대한 간략한 개요를 제공합니다. 🚀 ...

SRS - Command Injection

SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerable to a drive-by command injection. id: CVE-2023-34105 info: name: SRS - Command Injection author: iamnoooob,rootxharsh,pdresearch severity: high description: | SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerab...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

PoC-CVE-2026-23744

PoC-CVE-2026-23744 MCPJam Inspector 参考 https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6...

CVE-2020-8559

Kubernetes CVE-2020-8559 개념 증명 PoC 익스플로잇 이것은 데모 목적으로만 사용됩니다. 관리 작업을 수행할 권한이 있고 CVE-2020-8559을 악용할 권한이 있는 시스템에서만 사용하십시오. 이것은 CVE-2020-8559에 대한 PoC입니다. 이 취약점은 공격자가 노드에서 root를 획득한 경우 클러스터의 다른 컨테이너에서 명령을 실행할 수 있게 하여 Kubernetes 마스터 노드를 장악할 수 있게 합니다. 이 취약점은 Kubernetes API 서버와 kubectl 명령이 HTTP 리디렉션을 따르는...

CVE-2026-57443

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

EUVD-2026-87356

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

PT-2026-99120

Name of the Vulnerable Software and Affected Versions SCBE-AETHERMOORE versions 4.0.2 through 4.2.0 Description The AetherBrowser API server scripts/aetherbrowser/api server.py exposes the POST /api/ops/check-email endpoint without authentication. A remote attacker can call this endpoint to trigg...

CVE-2026-57443: Missing Authentication for Critical Function

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

PT-2026-96823

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description The LightRAG API server returns raw Python exception text in HTTP error responses across multiple routers, including document routes.py, graph routes.py, query routes.py, ollama api.py, and lightrag...

CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61629: Allocation of Resources Without Limits or Throttling

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

PT-2026-84514

Name of the Vulnerable Software and Affected Versions hermes-agent version 0.18.0 Description A flaw in the Session Chat Interface component, specifically within the gateway/platforms/api server.py file, allows a remote attacker to cause a denial of service. Recommendations At the moment, there i...

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

CVE-2026-55585 QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...

EUVD-2026-65580

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...

CVE-2026-55585 QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...

CVE-2026-55585 QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...

CVE-2026-55585

QWED (open-source AI verification infrastructure) prior to version 5.1.2 is vulnerable to authenticated Remote Code Execution . Caller-controlled math expressions are passed directly to SymPy parse_expr() without restricted global_dict/local_dict namespaces, effectively allowing Python eval() to ...