bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

drozer

drozer drozer는 Android를 위한 보안 테스트 프레임워크입니다. drozer는 앱의 역할을 가정하고 Android Runtime, 다른 앱의 IPC 엔드포인트 및 기본 OS와 상호작용하여 앱과 기기에서 보안 취약점을 검색할 수 있게 해줍니다. drozer는 공개된 Android 익스플로잇을 사용, 공유 및 이해하는 데 도움이 되는 도구를 제공합니다. drozer는 Reversec에서 유지 관리하는 오픈 소스 소프트웨어입니다. 입문 사용자 가이드는 Reversec Labs에서 찾을 수 있습니다. NOTE 이것은 다...

zap-hud

ZAP 헤즈업 디스플레이 HUD는 더 이상 활발히 개발되지 않습니다 안타깝게도 HUD는 더 이상 활발히 개발되지 않습니다. 아무도 이에 집중하지 않기 때문입니다. HUD는 독특하고 혁신적인 인터페이스로, 일부 사람들이 좋아한다는 것을 알고 있습니다. 그러나 상당한 유지보수가 필요하며 현재 이를 유지할 충분한 자원봉사자가 없습니다. 참여를 원하시면 ZAP HUD 그룹을 통해 연락해 주세요. HUD를 계속 유지하기 위해 실제로 Java 경험이 있는 사람은 필요하지 않습니다. 그 부분은 이미 충당되어 있습니다. 좋은 JavaScri...

jok3r

.. raw:: html .. image:: ./pictures/logo.png .. raw:: html Jok3r v3 beta .. image:: https://img.shields.io/badge/python-3.6-blue.svg :target: https://www.python.org/downloads/release/python-366/ :alt: Python 3.6 .. image:: https://readthedocs.org/projects/jok3r/badge/?version=latest :target:...

Emby Server - Authentication Bypass

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

gitlab-profile

테스트 상태 : ↳ 코어 오케스트레이터 테스터 ↳ 문서 테스터 생성 날짜: 2025-10-24 09:50 PM ↳ Alberto Marangelo - @theGlitched !WARNING ⚠️ 이 프로젝트는 베타 버전입니다! 🎉 네! 베타 버전이 곧 완성될 예정임을 알려드리게 되어 기쁩니다! 버전 0.153부터 첫 번째 V1 릴리스 프로세스에 대한 모든 테스트가 시작되었습니다! ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░░█▀▀░▀█▀░█▀█░█░█░▀█▀░█▀▀░░░░░░░░░░░░░░...

reconftw v5.0.0-beta.1

reconFTW reconFTW is a powerful automated reconnaissance tool designed for security researchers and penetration testers. It streamlines the process of gathering intelligence on a target by performing subdomain enumeration, vulnerability scanning, OSINT and more. With a modular design, extensive...

CVE-2026-66756

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

PT-2026-66571

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

EUVD-2026-45410

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialedexec.go. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CheckSSRF function in webshared.go of the webfetch component. An attacker can access internal network resources and potentially exfiltrate sensitive information or manipulate internal services by...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CheckSSRF function in webshared.go of the webfetch component. An attacker can access internal network resources and potentially exfiltrate sensitive information or manipulate internal services by...

GHSA-C4GH-RV8H-Q9VW Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Summary The TypeScript Prompty loader used gray-matter without overriding executable frontmatter engines. gray-matter supports JavaScript frontmatter blocks such as ---js and evaluates them while parsing. An attacker-controlled .prompty file could therefore execute arbitrary JavaScript during...

CVE-2026-34047

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources...

CVE-2026-34152 Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to...

EUVD-2026-41987

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the sentineltoken setting is used in shell commands without sufficient validation, allowing an authenticated user with access to server Sentinel settings to inject shell...

CVE-2026-34058

CVE-2026-34058 : Coolify prior to 4.0.0-beta.471 is vulnerable to OS Command Injection in the Livewire component Server\Resources. The public methods startUnmanaged, stopUnmanaged, and restartUnmanaged accept a container ID directly from the browser without sanitization, and this value is interpo...

EUVD-2026-41955

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

EUVD-2026-41949

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and...

CVE-2026-32718 Coolify read-scoped API tokens can perform state-changing validation operations

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and...