uptux

uptux Specialized privilege escalation checks for Linux systems. Implemented so far: Writable systemd paths, services, timers, and socket units Disassembles systemd unit files looking for: References to executables that are writable References to broken symlinks pointing to writeable directories...

CVE-2026-103863

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader, repeated calls to...

EUVD-2026-117431

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader, repeated calls to...

jaeles

!IMPORTANT This repository has been archived and is no longer maintained. Check out github.com/vigolium/vigolium — a brand new scanner that I made that's better in every way. Jaeles is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner...

sysflow

SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...

loupe

Loupe Loupe is an iOS and iPadOS app that gives you a hands-on tour of the device fingerprinting surface. It reads real values from public iOS APIs, the same ones any third-party app can call, and shows them to you raw. The point is simple: see what your iPhone quietly exposes, and why each readi...

graphql-cop

GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...

mitmproxy2swagger

mitmproxy2swagger https://user-images.githubusercontent.com/5400940/168086818-c48f60ab-3f95-42eb-b435-c8b1a6326b81.mp4 A tool for automatically converting mitmproxy captures to OpenAPI 3.0 specifications. This means that you can automatically reverse-engineer REST APIs by just running the apps an...

zdr

Zero Data Retention ZDR for LLM Providers Last updated: April 2026 A practical guide to keeping your data private when using LLM APIs. Covers zero-retention endpoints, self-hosting, compliance requirements, and data protection patterns for engineers in regulated industries. Table of Contents Whic...

mzap

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...

netlas-cookbook

Netlas CookBook The goal of this guide is to teach anyone interested in cybersecurity, regardless of their knowledge level, how to make the most of Netlas Search Tools. This is a long read. We have collected as many simple use cases as possible and demonstrated how to automate them. ⭐️ Give us a...

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

N-able N-central - Authentication Bypass

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal-only APIs. id: CVE-2026-86207 info: name: N-able N-central - Authentication Bypass author: rapid7,DhiyaneshDk severity: critical description: | An authentication bypass in N-central 2026.3 HF 3 leads to...

Vanna - SQL injection

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

CVE-2026-107479

An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash...

EUVD-2026-116890

An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash...

EUVD-2026-116531

All versions of StorageGRID formerly StorageGRID Webscale in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid...

PT-2026-136945

An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash...

CVE-2026-107479: Qt: An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module…

An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash...