nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

udpack

UDPack UDPack is an extensible generic UDP packet obfuscator. The purpose of this application is to sit in the path of a UDP data stream, and obfuscate, deobfuscate or otherwise modify the packets. Python 3.4 or above is required, since this script uses the asyncio library. Using the latest Pytho...

udpack

UDPack UDPack 是一个可扩展的通用 UDP 数据包混淆器。该应用的目的是位于 UDP 数据流路径中，对数据包进行混淆、去混淆或以其他方式修改。 需要 Python 3.4 或更高版本，因为此脚本使用了 asyncio 库。始终强烈建议使用最新的 Python 版本。基本功能无需第三方依赖，但 XChaCha20Poly1305Packer 需要 PyNaCl。 警告： 必须强调，本应用的目的在于 混淆 ，而非 加密 。许多设计决策有意违背了密码学最佳实践，因此混淆方法很可能无法抵抗密码分析。切勿 依赖此混淆来保障数据的机密性！！！ 当前版本将网络部分分离为独立的 Manage...

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

Raccoon

Raccoon 用于侦察和信息收集的进攻性安全工具 功能特性 DNS 详情 使用 DNS dumpster 进行 DNS 可视化映射 WHOIS 信息 TLS 数据 – 支持的密码套件、TLS 版本、证书详情和 SAN 端口扫描 服务和脚本扫描 URL 模糊测试和目录/文件检测 子域名枚举 – 使用 Google dorking、DNS dumpster 查询、SAN 发现和暴力破解 Web 应用数据检索： CMS 检测 Web 服务器信息和 X-Powered-By robots.txt 和 sitemap 提取 Cookie 检查 提取所有可模糊测试的 URL 发现 HTML 表单...

knxmap

KNXmap KNXmapは、IPベースのネットワーク上でKNXnet/IPゲートウェイをスキャンおよび監査するためのツールです。KNXnet/IPは、KNX（EN 50090、ISO/IEC 14543）の物理通信媒体としてEthernetを定義しています。KNXmapは、KNXnet/IPゲートウェイを介してKNXバス上のデバイスをスキャンすることも可能です。スキャンに加えて、KNXmapは、バスメッセージの監視やグループアドレスへの任意の値の書き込みなど、KNXゲートウェイと対話するための他のモードもサポートしています。 互換性...

CVE-2026-21018-OPC-UA-Authentication-Bypass-via-None-Security-Policy

CVE-2026-21018 – 通过 None 安全策略绕过 OPC UA 身份验证 程序代码（Python opcua-asyncio 模拟） opcuaserversim.py - OPC UA server accepting None security policy from asyncua import Server import asyncio async def main: server = Server await server.init server.setendpoint'opc.tcp://0.0.0.0:4840/freeopcua/server/'...

CVE-2026-64847 AnyIO process-pool workers can block indefinitely on undrained stderr

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

Linux Distros Unpatched Vulnerability : CVE-2026-62949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

Arbitrary Argument Injection

Overview aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio. Affected versions of this package are vulnerable to Arbitrary Argument Injection in the parseaddress function of src/aiosmtplib/email.py, which returns parsedaddress or address.strip, so a malformed mailbox...

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

SummaryChat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

GHSA-3CGP-3CQX-J8W2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

GHSA-JQHH-CJMQ-VMV6 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

UBUNTU-CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-53533

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

CVE-2026-53533

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

CVE-2026-53533 aiosmtplib: SMTP command injection via CR/LF in sender/recipient address

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

CVE-2026-69243: Inconsistent Interpretation of HTTP Requests

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...