How Far Are We? an Empirical Analysis of Current Vulnerability Localization Approaches

Open-source software vulnerability patch detection is a critical component for maintaining software security and ensuring software supply chain integrity. Traditional manual detection methods face significant scalability challenges when processing large volumes of commit histories, while being...

SUSE CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

VulnCheck KEV: CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

PhishParrot: LLM-Driven Adaptive Crawling to Unveil Cloaked Phishing Sites

Phishing attacks continue to evolve, with cloaking techniques posing a significant challenge to detection efforts. Cloaking allows attackers to display phishing sites only to specific users while presenting legitimate pages to security crawlers, rendering traditional detection systems ineffective...

Scoring the Unscorables: Cyber Risk Assessment beyond Internet Scans

In this paper we present a study on using novel data types to perform cyber risk quantification by estimating the likelihood of a data breach. We demonstrate that it is feasible to build a highly accurate cyber risk assessment model using public and readily available technology signatures obtaine...

Bandit on the Hunt: Dynamic Crawling for Cyber Threat Intelligence

Public information contains valuable Cyber Threat Intelligence CTI that is used to prevent future attacks. While standards exist for sharing this information, much appears in non-standardized news articles or blogs. Monitoring online sources for threats is time-consuming and source selection is...

CVE-2025-27600

FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attacker can initiate an intranet IP request, causing the system to initiate a request through the intranet and potentially obtain some private data on the intrane...

CVE-2025-27600 FastGPT SSRF

FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attacker can initiate an intranet IP request, causing the system to initiate a request through the intranet and potentially obtain some private data on the intrane...

PT-2025-10000

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.9.0 Description The issue arises from the web crawling plug-in's failure to perform intranet IP verification. This allows an attacker to initiate an intranet IP request, causing the system to make a request through...

CVE-2025-27419 Denial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLs

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service DoS vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing aggressive spidering. The vulnerabilit...

CVE-2025-27419 Denial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLs

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service DoS vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing aggressive spidering. The vulnerabilit...

Anubis 安全漏洞

Anubis is a tool by Xe Iaso Individual Developers. Anubis has a security vulnerability that stems from allowing administrators to protect bots from AI crawling tools by bot-checking heuristic algorithms and proof-of-work challenges to block crawling from multiple IP addresses...

vulnerability scanner

This is a Java-based web vulnerability scanner. The tool is classified as an offensive tool for web vulnerability scanning. The primary vulnerability being targeted is not explicitly stated, but based on the code and metadata, it appears to be a web application scanner that can perform SQL...

Fedora: Security Advisory (FEDORA-2024-c27b82d702)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: python-scrapy-2.11.2-1.fc39

Scrapy is a fast high-level screen scraping and web crawling framework, used to crawl websites and extract structured data from their pages. It can be used for a wide range of purposes, from data mining to monitoring and automated testing...

Quivr Code Issue Vulnerability

Quivr is an artificial intelligence application open-sourced by Quivr. A code issue vulnerability exists in Quivr version 0.0.236 that stems from the application not providing sufficient controls when crawling websites, allowing an attacker to access the application on the local network...

PT-2024-37222 · Quivr · Quivr

Name of the Vulnerable Software and Affected Versions: stangirard/quivr version 0.0.236 Description: The application contains a Server-Side Request Forgery SSRF vulnerability due to insufficient controls when crawling a website. This allows an attacker to access applications on the local network,...

PT-2024-22350 · Contao · Contao

Name of the Vulnerable Software and Affected Versions: Contao versions 4.9.0 through 4.13.39 Contao versions 5.0.0 through 5.3.3 Description: The issue arises when checking for broken links on protected pages, causing Contao to send the cookie header to external URLs. The passed options for the...

InsightAppSec: Improving Scan Speed and Performance

When scanning a web application in InsightAppSec, you might see it take several hours, if not several days, to run. This can be due to the size of your web app, but plenty of settings in your scan configuration can be modified to help scans complete faster. The first setting is Info - Enable...

Uscrapper - Powerful OSINT Webscraper For Personal Data Collection

Introducing Uscrapper 2.0, A powerfull OSINT webscrapper that allows users to extract various personal information from a website. It leverages web scraping techniques and regular expressions to extract email addresses, social media links, author names, geolocations, phone numbers, and usernames...