osint-tools-mcp-server

🔍 OSINT工具MCP服务器 一个全面的MCP服务器，向Claude等AI助手开放多个OSINT工具。该服务器允许AI利用行业标准的OSINT工具执行复杂的情报收集和信息搜集任务。 🛠️ 可用工具 🔍 Sherlock - 用户名搜索 在399多个社交媒体平台和网站上搜索用户名。非常适合数字足迹分析。 输入 : 用户名 输出 : 存在该用户名的平台列表 📧 Holehe - 邮箱验证 检查邮箱是否已在120多个平台上注册。速度快且准确。 输入 : 邮箱地址 输出 : 邮箱已注册的平台 🕷️ SpiderFoot - 全面OSINT...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 La vulnerabilidad fue causada por un error en la forma en que GitLab manejaba la verificación de correo electrónico durante el restablecimiento de contraseña. Un atacante podía proporcionar dos direcciones de correo electrónico en una...

CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab Tổng quan Lab mô phỏng lỗ hổng CVE-2026-18963 CVSS 9.1 trong Keycloak, cho phép kẻ tấn công chiếm quyền tài khoản bất kỳ thông qua bypass xác minh email trong luồng đặt lại mật khẩu. Chỉ sử dụng cho mục đích nghiên cứu bảo mật và giáo dụ...

poastal

Poastal - 电子邮件 OSINT 工具 Poastal 是一个电子邮件 OSINT 工具，能提供任何电子邮件地址的有价值信息。使用 Poastal，您可以轻松输入一个电子邮件地址，它会迅速回答几个问题，为您提供关键信息。 ✨ 功能特性 确定拥有该电子邮件的人员姓名。 检查电子邮件是否可投递。 查明电子邮件是否为临时邮箱。 识别该电子邮件是否被视为垃圾邮件。 检查该电子邮件是否在热门平台（如 Facebook、Twitter、Snapchat、Parler、Rumble、MeWe、Imgur、Adobe、Wordpress 和 Duolingo）上注册。 💻 使用说明...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

CVE-2021-34646

CVE-2021-34646 PoC this vulnerability detail by NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink...

CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA plugin de WordPress miniorange-2-factor-authentication ≤ 6.3.0 — eliminación arbitraria de opciones de WordPress sin autenticación a través del enlace de verificación por correo electrónico userID / Txid / accessToken. Solo para pruebas...

CVE-2024-24139

CVE-2024-24139: 带邮箱验证的登录系统SQL注入 概念验证PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24139.md 概念验证PoC : https://github.com/BurakSevben/CVE-2024-24139/blob/main/CVE-2024-24139.md...

EUVD-2026-42966

ZITADEL: Auto-linking by email: IdP-side email verification is not checked...

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incomi...

anti-anti-automation

Anti-Anti-Automation Framework Un framework de técnicas para evadir los controles de seguridad anti-automatización comunes. Controles comunes anti-automatización Verificación de correo electrónico CAPTCHA SMS/Teléfono Tarjeta de crédito WASC-21: Anti-automatización insuficiente...

CVE-2026-86722

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

EUVD-2026-72858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

CVE-2026-86722

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by an authentication bypass rooted in its SQL data layer: sqlDAL caches empty result sets that writeSql never invalidates. As a result, when a user attempts two-factor authentication on a new device, the confirmation code ...

Oracle Linux 8 : ELSA-2026-62407-0: / grafana (ELSA-2026-624070)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-624070 advisory. - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 - Resolves RHEL-219393: CVE-2026-42127 Tenable has extracted t...

CVE-2026-82968 Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacke...

grafana security update

9.2.10-33.0.1 - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 9.2.10-33 - Rebuild against updated golang - Resolves RHEL-251835 - Resolves RHEL-251696 - Resolves RHEL-242383 - Resolves RHEL-242344 - Resolves RHEL-242224 - Resolves RHEL-242108 - Resolves...

PT-2026-84668

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...