mnemosyne

Mnemosyne es una herramienta genérica de scraping de memoria basada en Windows. Escanea el espacio de memoria de un proceso en busca de una cadena de búsqueda o expresión regular regex unicode y ascii y, si la encuentra, la envía ya sea a stdout, a un archivo o a un socket hacia un listener remot...

CVE-2026-88888

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

CVE-2026-88888

Renovate before 44.14.7 is affected by a command injection vulnerability in the Mix manager . The root cause is unescaped organization parameters when processing private dependencies, allowing attackers to inject shell metacharacters through malicious package names. Successful exploitation enable...

CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

are-you-get-tanstack-attack

Escáner de CVE de TanStack Router Una herramienta de escaneo de seguridad para detectar el CVE de TanStack Router | GHSA de TanStack Router en tus proyectos. Resumen Esta herramienta escanea tu código en busca de indicadores de la vulnerabilidad de TanStack Router CVE-2026-45321 /...

agentic-ioc-scanner

agentic-ioc-scanner 针对自主AI编码工具的IOC扫描器——检测 Mini Shai-Hulud、Gemini CLI RCE、Cursor CVE-2026-26268 以及 DPRK PromptMink。 一个检测工具包，用于检测自主AI编码助手（Claude Code、Gemini CLI、Cursor）及其拉入仓库的依赖项是否受到危害。共十一个检查项，涵盖钩子注入、RCE配置、恶意依赖、Git钩子后门以及CI工作流篡改。IOC列表外部化——添加新指标无需修改代码。 配套博客文章：When the Tool Fights Back。 包含内容 1. IOC扫描器...

halo-record v0.2.42

halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your agent takes tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only, hash-chained log; the...

k4_cve-2023-41064

k4cve-2023-41064 运行项目的步骤 设置前端： 导航到前端文件夹： root@kitploit: Copier Modifier cd frontend 通过运行以下命令安装所需的Node.js依赖项： root@kitploit: Copier Modifier npm install 设置后端： 导航到后端文件夹： root@kitploit: Copier Modifier cd backend 通过运行以下命令安装所需的Python依赖项： root@kitploit: Copier Modifier pip install -r requirements.txt...

CVE-2026-87056

A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

craready-test-java-vulns

craready-test-java-vulns CRAReady SBOM/CVE 扫描器测试夹具 — 请勿在生产环境中使用 该仓库包含故意存在漏洞的 Java（Maven）依赖项，用于测试 CRAReady 的 SBOM 生成和漏洞检测流水线。其中包含近年来一些影响最重大的 CVE。 包含的已知 CVE Package| Version| CVE| CVSS| Description ---|---|---|---|--- log4j-core| 2.14.1| CVE-2021-44228| 10.0 严重| Log4Shell — 通过日志消息中的 JNDI 查找实现远程代码执行...

ALSA-2026:65117 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

CVE-2021-42694

CVE-2021-42694 使用最近公布的同形字攻击漏洞生成恶意文件，该漏洞至少已在 C、C++、C、Go、Python、Rust、JS 等语言中发现。 引用自 cve.mitre.org 在 Unicode 规范至 14.0 版的字符定义中发现了一个问题。该规范允许攻击者使用同形字生成源代码标识符（如函数名），这些标识符在视觉上与目标标识符完全相同。攻击者可利用这一点，通过在上游软件依赖项中定义对抗性标识符来注入代码，这些依赖项在下游软件中被欺骗性地调用。 同形字的原始数据（homoglyphs.txt）取自此处，并已清理数据以排除斜体和外观差异较大的字符。 查看剑桥大学的原始来源：...

OPENSUSE-SU-2026:21801-1 Security update for trivy

This update for trivy fixes the following issues: - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates bsc1258543. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP meth...

CVE-2022-51000

Nokogiri before 1.13.2, when using bundled libxml2 and libxslt, is affected by the libxslt flaw CVE-2021-30560 and the libxml2 flaw CVE-2022-23308...

CVE-2026-84428

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428

fastify versions before 5.12.2 are vulnerable to a header validation bypass caused by incomplete case normalization in the JSON Schema Draft 7 dependencies keyword. While the library lowercases property keys and the root-level required array to accommodate HTTP's case-insensitive headers, it fail...

EUVD-2026-70998

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...