91626 matches found
magic-extractor v1.3.1
Magic Extractor Description Magic Extractor is a universal extraction tool for Windows that identifies a file with several detectors and routes it to the right bundled extractor. It aims to cover mainstream compression formats, the installers you actually see today, and a range of less common...
Hx0-HawkEye v1.0.6
π¦ Hx0 HawkEye: Full-stack lightweight capture & AI security auditing extension γδΈζ / Englishγ 1. What it is Skip the proxy hassleβtruly ready out of the box. Hx0 HawkEye is a native browser extension Chrome / Firefox and mainstream Chromium that gives you a full capture, intercept HTTP + WebSocke...
threat-finder v0.3.0
OffSeq Threat Finder threat-finder finds the vulnerable software actually running on a host β not what a manifest claims β and tells you which findings are network-reachable. It resolves each running service and, with --scope all, every installed OS package to an exact Package-URL and matches it...
EUVD-2026-66805
HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow...
EUVD-2026-66775
HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary...
androidReverse v20
Android Reverse A reverse engineering suite that runs entirely on Android. No PC, no ADB, no desktop tools β everything from APK extraction to native binary analysis happens on-device. MCP Server androidReverse includes a built-in Model Context Protocol server, allowing MCP-compatible AI clients ...
Escargot 4.3.0-214-gfaee4437 Buffer Overflow
Escargot contains a remotely triggerable one-byte stack-based out-of-bounds write in the WebSocket message handling logic used by the debugger. Escargot contains a remotely triggerable one-byte stack-based out-of-bounds write in the WebSocket message handling logic used by the debugger. When...
...[ More ]
Chronicle Wire's FileMarshallableOut follows symbolic links when writing files in append mode. When ?append=true is enabled, the implementation opens the supplied output path directly using FileOutputStreampath, true without preventing symbolic-link resolution. If an attacker can create or replac...
Decoupling Is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation
Reverse engineering is essential for software security analysis and vulnerability detection. Decompilation, the process of lifting binaries to high-level pseudocode, is central to this task. However, production binaries are hostile environments: aggressive compiler optimizations and adversarial...
...[ More ]
WatsonWebserver contains an HTTP/1 request body size-limit bypass when processing requests using Transfer-Encoding: chunked. The framework's configured Settings.IO.MaxRequestBodySize limit is enforced when a request declares its body size using Content-Length. However, requests using chunked...
Realtek Edimax 52fc10d19 Heap Buffer Overflow
The Realtek in-band ioctl bridge contains a heap buffer overflow when processing peer-supplied ioctl response data. The Realtek in-band ioctl bridge contains a heap-buffer overflow when processing peer-supplied ioctl response data. inbandioctl receives a response through the Realtek in-band...
Beyond F1: Evaluating Coverage and Failure Recovery in AI Model Security Scanners
Static scanners are increasingly used to identify executable or otherwise unsafe content in machine- learning artifacts, yet conventional evaluation metrics characterize only cases where a scanner yields a usable security judgment. We evaluate ModelScan, ModelAudit, and Fickling using a controlle...
NitroShare Desktop 0.3.4 Path Traversal
NitroShare Desktop version 0.3.4 contains a path traversal vulnerability in its LAN file transfer receive path. The transfer service is reachable from the local network on TCP port 40818 and processes incoming transfer metadata without authentication in the reported default configuration. A...
UltraJSON 5.13.0-6-g733f9e1 Out-Of-Bounds Read
UltraJSON version 5.13.0-6-g733f9e1 suffers from an out of bounds read vulnerability. UltraJSON contains an out-of-bounds read in its native C JSON decoder when processing certain incomplete JSON values supplied through an explicitly length-bounded input buffer. The affected native entry point,...
Escargot 4.3.0-214-gfaee4437 Command Injection
An OS command injection vulnerability exists in the Escargot version 4.3.0-214-gfaee4437 crash handler due to an executable/module path being incorporated into an addr2line shell command without quoting or escaping. The resulting command is executed using system, causing shell metacharacters...
PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)
This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...
Chronicle Wire 2026.8 Class Instantiation
Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation during untyped deserialization. Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation durin...
...[ More ]
Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events to Java handler methods. During initialization, the framework discovers public methods exposed by the registered handler interfaces and registers those methods as callable wire events. When a...
...[ More ]
An unauthenticated remote debugger vulnerability exists in Escargot version 4.3.0-214-gfaee4437 when the application is compiled with ESCARGOTDEBUGGER support and the debug server is enabled using --start-debug-server. The debugger accepts client connections without authentication or authorizatio...
gosentry v0.4.1
gosentry gosentry is a security-focused fork of the Go toolchain, integrating numerous features for state-of-the-art fuzzing campaigns on Go codebases. If you were using go test -fuzz before, you should use gosentry as a replacement. It comes with various fuzzing improvements and bug detectors th...