Dumb

Dumb - Брутфорсер Dumain доменов Инструмент для брутфорса dumain! Dumb Как работает DUMB: Dumb работает с маскированным dumain для подстановки. Dumain может содержать столько масок, сколько вы хотите, если вы передаёте соответствующие списки слов. Например: Брутфорс subdumain: Используя маску...

bug-bounty-domains

ДОМЕНЫ ДЛЯ ПРОГРАММ ВОЗНАГРАЖДЕНИЙ ЗА УЯЗВИМОСТИ Домены, принадлежащие наиболее известным публичным программам вознаграждений за уязвимости. НЕ ДЛЯ НЕДЕНЕЖНЫХ ИЛИ ЧАСТНЫХ ПРОГРАММ !https://assets.kitploit.com/production/public/readm...

CVE-2024-38526

CVE-2024-38526 - Polyfill Scanner: x Mass Urls Scanner CDN polyfill.io, ранее скомпрометированный для распространения вредоносного кода, теперь защищен последним исправлением в pdoc 14.5.1. Обзор Обнаруживать потенциальные проблемы Автоматизировать повторяющиеся задачи с легкостью Возможности...

class_struggle

Классовая борьба Репозиторий, сопровождающий статью "Классовая борьба". Репозиторий демонстрирует использование автоэнкодера для обнаружения доменов, похожих на известное подмножество фишинговых доменов, опубликованное CERT Polska. Источники данных Список предупреждений CERT Polska Этот проект...

OverAct: Measuring and Mitigating Proactive Over-Authorization in LLM Tool-Calling Agents

LLM agents with tool-calling capabilities can access external services and private user data, but they may retrieve more information than a user's request explicitly requires. We study this behavior in structured tool-calling agents and term it proactive over-authorization. This setting differs...

CVE-2026-102106

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-102106 Kiteworks Email Protection Gateway improper authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-102106

The Kiteworks Email Protection Gateway contains an improper authentication vulnerability within an administrative service. The root cause is that the service fails to consistently enforce administrator authentication, allowing a required password check to be bypassed. An attacker referencing a va...

MAL-2026-17339 Malicious code in reactjs-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...

PT-2026-103596

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An administrative service in Kiteworks Email Protection Gateway fails to consistently enforce administrator authentication, allowing the password check to be...

Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. Setup.exe – 개인정보, 드라이버 및 메모리 문자열 setup.exe 드로퍼에 대한 Process Hacker 메모리 분석 결과, Lumma Stealer가 개인정보 설정을 대상으로 하고, 드라이버를 설치하며, 메모리를 관리하는 것으로 나타났습니다. 관찰된 주요 문자열: Privacy Camera – 카메라 개인정보 설정에 접근하거나 비활성화를 시도합니다. Privacy Microphone – 마이크 개인정보 설정에 접근하거나 비활성화를 시도합니다. PreinstallDriver – 지속성 또는 탐지 회피를 위한...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

domains-from-csp

domains-from-csp CSP 헤더에서 도메인 이름을 파싱하는 Python 스크립트 Content Security PolicyCSP 헤더에서 도메인 이름을 추출하는 스크립트 현재 출력은 stdout으로 출력됩니다 데모 스크린샷 서드파티 패키지 의존성 requests click 설치 이 저장소를 클론하세요 $ git clone [email protected]:yamakira/censys-enumeration.git 의존성을 설치하세요 $ pipenv install 도움말 메뉴를 확인하세요 $ python...

ThreatIntelligenceDiscordBot

위협 인텔리전스 Discord 봇 vx-underground 위협 인텔리전스 Discord 봇은 다양한 클리어넷 도메인, 랜섬웨어 위협 행위자 도메인 및 Telegram 채널에서 업데이트를 가져옵니다. 이 봇은 1800초 간격으로 업데이트를 확인합니다Telegram 봇은 제외, 실시간으로 수신됨. 직접 설정하고 싶지 않으신가요? 이 위협 인텔리전스 봇이 지금 Discord에서 운영 중입니다. Python 3.10 64bit로 작성됨 Windows 또는 Linux에서 실행 가능 Discord Webhook 필요 모니터링하려는...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the Domains::get, Domains::listing, SubDomains::get, and SubDomains::listing API functions. An attacker can access DKIM private signing keys belonging to othe...

PT-2026-98818

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.8 and 6.18 LTS Description An issue exists in the drm/virtio component where the virtio-gpu driver fails to correctly use the DMA API for resource backing on Xen PV domains. In these domains, page addresses do not...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

Antiphishing v35456910988

Antiphishing — Predictive Phishing Intelligence for Suricata DONATE · DASHBOARD VECTORS · CONTRIBUTING · SUBMIT A VECTOR · REST API CTI · WIKI Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero Antiphishing is an open-source GPLv3 Cyber Threat Intelligence CTI...

CVE-2026-92359 ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...

CVE-2026-92359

CVE-2026-92359 affects ag-ui-protocol ag-ui 0.3.0 , specifically the CORSMiddleware component in the create_strands_app function within integrations/aws-strands/python/src/ag_ui_strands/utils.py. The root cause is a permissive cross-domain policy that allows untrusted domains, potentially enablin...