CVE-2026-105926

The Apache Pulsar broker is vulnerable to missing authorization checks on specific binary protocol commands. Specifically, the GetSchema and GetOrCreateSchema commands fail to verify if an authenticated client has permissions for the target topic, namespace, or tenant. An attacker could use these...

MasterHttpRelayVPN-RUST

mhrv-rs — bypass censorship for free, with your own Google account A small program that runs on your computer and lets you visit blocked websites for free, using a Google Apps Script you deploy in your own free Google account. Your ISP only sees encrypted traffic towww.google.com — it can't tell...

SSCMS_Decrypt

sscms siteserver cms database decrypt Introduction: SSCMS is based on .NET Core, enabling you to set up a fully functional, high-performance, large-scale, and easy-to-maintain website platform in the shortest time, at the lowest cost, and with the least manpower. Project address:...

Adm-zip: Duplicate ZIP Entry Names: GetEntry() And ExtractAllTo() Resolve To Different Content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. "getEntryname" and "extractAllTo" walk these two different internal structures, so they can each resolve a duplicate name...

EUVD-2026-107422

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

CVE-2026-105869

Apache Pulsar's MultiRolesTokenAuthorizationProvider contains a vulnerability where it fails to verify the signature of JSON Web Tokens (JWT) during authorization. When anonymousUserRole is set to a non-empty value and strictAuthMethod is false (default), requests with failed credentials may fall...

CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

mail-security-tester

Mail Security Testing Framework A testing framework for mail security and filtering solutions. IMPORTANT: Don't do anything evil with this! Tests of cloud or otherwise hosted solutions should always be approved by the tested provider. Only use your own test accounts and don't annoy anyone with a...

dangerzone

Dangerzone Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF. | ---|--- Dangerzone works like this: You give it a document that you don't know if you can trust for example, an email attachment. Inside of a sandbox, Dangerzone converts the document to a PD...

react2shell_detector

React2Shell Detector Heuristic Scanner for React Server Components RSC Vulnerabilities — including React2Shell-style behavior CVE-2025-55182 Overview react2shelldetector.py is a safe, non-invasive security scanner designed to detect systems potentially exposed to React Server Components RSC...

zarp

Introduction Zarp is a network attack tool centered around the exploitation of local networks. This does not include system exploitation, but rather abusing networking protocols and stacks to take over, infiltrate, and knock out. Sessions can be managed to quickly poison and sniff multiple system...

StaCoAn

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credential...

BLAKE3

BLAKE3 BLAKE3 is a cryptographic hash function that is: Much faster than MD5, SHA-1, SHA-2, SHA-3, and BLAKE2. Secure , unlike MD5 and SHA-1. And secure against length extension, unlike SHA-2. Highly parallelizable across any number of threads and SIMD lanes, because it's a Merkle tree on the...

masscan

MASSCAN: Mass IP port scanner This is an Internet-scale port scanner. It can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine. Its usage parameters, output is similar to nmap, the most famous port scanner. When in doubt, try one of tho...

Blackash-CVE-2025-61884

CVE-2025-61884 New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login 💀 CVE-2025-61884 — Complete summary 🧾💥 Field| Details ---|--- Identifier| CVE-2025-61884 Product| Oracle E-Business Suite — Oracle Configurator Runtime UI Affected versions| 12.2.3 → 12.2.14 Attack vector|...

365Inspect

Purpose Further the state of Microsoft 365 security by authoring a PowerShell script that automates the security assessment of Microsoft 365 environments. Soteria Inspect Soteria Inspect is born from the 365Inspect project and is Soteria's SaaS solution to aid in assessing the security of a...

tweetable-polyglot-png

tweetable-polyglot-png Pack up to 3MB of data into a tweetable PNG polyglot file. See it in action here: https://twitter.com/David3141593/status/1371974874856587268 Other image hosts I've verified this technique to work on: Imgur https://i.imgur.com/kNhGrN3.png Github repo thumbnail/header image...

cve

CVE PoC Almost every publicly available CVE PoC. Current hottest CVEs Title| URL ---|--- CVE-2022-0001| /trickest/cve/blob/main/2022/CVE-2022-0001.md CVE-2022-25297| /trickest/cve/blob/main/2022/CVE-2022-25297.md CVE-2022-1388| /trickest/cve/blob/main/2022/CVE-2022-1388.md CVE-2022-25451|...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File Upload → RCE Proof-of-concept for CVE-2026-32475 CVSS 9.0: an unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin ≤ 4.2.1 that leads to remote code execution. | ---|--- CVE| CVE-2026-32475 CVSS| 9....

waybackpack

waybackpack Waybackpack is a command-line tool that lets you download the entire Wayback Machine archive for a given URL. For instance, to download every copy of the Department of Labor's homepage through 1996 which happens to be the first year the site was archived, you'd run: waybackpack...