tfsec

📣 tfsec to Trivy Migration As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy. Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations...

hashes

RustCrypto: Hashes !Project Chatchat-imagechat-link !dependency statusdeps-imagedeps-link !Apache2/MIT licensedlicense-image Collection of cryptographic hash functions1 written in pure Rust. All algorithms reside in separate crates and are implemented using traits from digest crate. Usage example...

CTT-enhanced-Apache-mod_auth_digest-timing-attack-exploit

CTT-enhanced-Apache-modauthdigest-timing-attack-exploit CTT-Enhanced Apache modauthdigest Timing Attack — CVE-2026-33006 Remote Digest Authentication Bypass → 33-Layer Temporal Timing Attack Original vulnerability: Apache HTTP Server 2.4.66 modauthdigest timing leak CTVSS Original: 4.8 Medium...

CVE-2026-7020

CVE-2026-7020 Ollama arbitrary file read via tensor digest path traversal. Exfiltrates SSH host keys and any other file from a reachable Ollama host in three unauthenticated API calls. Writeup: Co-Researcher @gouldnicholas Usage python3 poc.py Tries all three SSH host key types with known sizes a...

PoC_CVE-2019-0217

This repository contains a proof of concept exploit for CVE-2019-0217, along with a Dockerfile to set up a web server vulnerable to the CVE. CVE Description In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in modauthdigest when running in a threaded server could allow a user...

CVE-2017-6640-POC

CVE-2017-6640-POC Proof of concept for CVE-2017-6640 as burp extension Cisco Prime Data Center Network Manager DCNM implements a static credentials. See also: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2 More specifically, the Web UI requires users...

paskto

Paskto - Passive Web Scanner Paskto will passively scan the web using the Common Crawl internet index either by downloading the indexes on request or parsing data from your local system. URLs are then processed through Nikto and known URL lists to identify interesting content. Hash signatures are...

CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – VoIP SIP Digest Authentication Replay Program Code Python SIP sim sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces usednonces = set @app.route'/call',...

cve-2026-43512-poc

CVE-2026-43512 — Apache Tomcat DIGEST Authentication Bypass Exploitability analysis result: the root cause is confirmed. End-to-end exploitation is not reproducible against a standard UserDatabaseRealm deployment. See Analysis for details. Table of Contents Overview Affected Versions Root Cause...

CVE-2025-55182-VulnCheckPOC

CVE-2025-55182 Vulnerability Check PoC Proof-of-concept scanner for detecting React Server Components RSC vulnerability in Next.js applications CVE-2025-55182. Usage This is only a check to see if a server is vulnerable, based on this release by Searchlight Cyber...

EUVD-2026-105298

virtualenv: Pip seeding with download omits wheel digest verification...

CVE-2026-81642

CVE-2026-81642 — Unbound DNSKEY digest heap overflow tracking site Source for the CVE-2026-81642 patch-status tracker: a single-page site recording which distributions have shipped a fix for the Unbound DNSSEC validator heap overflows and the ReTrap complexity attacks disclosed alongside them...

ctf-party

ctf-party What it is A library to enhance and speed up script/exploit writing for CTF players or security researchers, bug bounty hunters, pentesters but mostly focused on CTF by patching the String class to add a short syntax of usual code patterns. The philosophy is also to keep the library to ...

Linux Distros Unpatched Vulnerability : CVE-2026-113717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling...

CLEANSTART-2026-LN18272 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

CVE-2026-10050 affects multiple packages. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. See references for individual vulnerability details...

squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Squid vulnerabilities (USN-8941-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8941-1 advisory. It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker cou...

DEBIAN-CVE-2026-113717

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113717

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113717

A flaw was found in virtualenv. When creating an environment using the pip seeder with the download option, the tool bypasses its package digest verification routines. A remote attacker controlling a package index could exploit this flaw to provide modified package files without triggering expect...