windiff

WinDiff About WinDiff is an open-source web-based tool that allows browsing and comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the operating system. The binary database is automatically updated to include information from the latest Windo...

auth

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

CVE-2026-40897

CVE-2026-40897 Remote Code Execution in Math.js Expression Parser ★ CVE-2026-40897 Remote Code Execution in Math.js PoC ★ https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898 Overview CVE-2026-40897 is a Sandbox Bypass leading to Remote Code Execution vulnerability in...

openedr

OpenEDR We at OpenEDR believe in creating a cybersecurity platform with its source code openly available to the public, where products and services can be provisioned and managed together. EDR is our starting point. OpenEDR is a full-blown EDR capability. It is one of the most sophisticated,...

CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

EUVD-2026-112359

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118257

The Vue I18n internationalization plugin for Vue.js is vulnerable to Cross-Site Scripting (XSS) in versions 11.1.10 through 11.4.14, 12.0.0-alpha.4 through 12.0.0-alpha.5, and legacy versions 9.14.5 and 10.0.8. The root cause is that the sanitizeTranslatedHtml() function escapes markup within an ...

sqlancer

SQLancer is a tool to automatically test Database Management Systems DBMSs in order to find bugs in their implementation. That is, it finds bugs in the code of the DBMS implementation, rather than in queries written by the user. SQLancer has found hundreds of bugs in mature and widely-known DBMSs...

KeePass-dump-py

KeePass-dump-py My attempt to re-write the original KeePass 2.X Master Password Dumper CVE-2023-32784 POC in python. Please head over to Original POC for more details about the vulnerability and exploitation process. What this script does: 1. Checks if KeePass process is running, otherwise it...

CVE-2024-25641-CACTI-RCE-1.2.26

CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵 Authenticated RCE Cacti version v1.2.26 Summary An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code ...

SleuthQL

SleuthQL Description SleuthQL is a python3 script to identify parameters and values that contain SQL-like syntax. Once identified, SleuthQL will then insert SQLMap identifiers into each parameter where the SQL-esque variables were identified. Supported Request Types SleuthQL requires an export of...

Inspector

Privilege Escalation unix helper SUMMARY Inspector is a python script for help in privilege escalation, for linux environement. After starting, this script search the kernel version and check if is exploit exists, load file history bash,zsh,mysql... and load list of programs loaded with root user...

Vanquish

Vanquish – Get to Shell Vanquish is a Kali Linux based Enumeration Orchestrator built in Python. Vanquish leverages the opensource enumeration tools on Kali to perform multiple active information gathering phases. The results of each phase are fed into the next phase to identify vulnerabilities...

infernal-twin

Infernal-Wireless v3 Release 3 Improved and Compatibility on Kali Linux 2018 Added Visual Representation of Wireless Scan Added Visual Representation of Probe Requests and Map per SSID requested by Devices Updated MAC address mapping Added MAC address mappting on probe request devices Evil Twin...

CVE-2024-3094

🚨 CVE-2024-3094 — XZ Utils Backdoor 🧠 Overview CVE-2024-3094 is a critical supply chain compromise affecting the widely used XZ Utils compression library. A malicious actor inserted a stealth backdoor into upstream releases, enabling remote code execution RCE via tampered liblzma. ⚠️ This...

webvm

WebVM This repository hosts the source code for https://webvm.io, a Linux virtual machine that runs in your browser. Try out the new Alpine / Xorg / i3 graphical environment: https://webvm.io/alpine.html WebVM is a server-less virtual environment running fully client-side in HTML5/WebAssembly. It...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana Unauthorized File Read Affected versions: 8.0.0-lastest reference: - https://github.com/tangxiaofeng7/Grafana-File-Read Exploit the Grafana /public/plugins endpoint's lax URL route validation vulnerability to read arbitrary local files from the server. poc:...

MAL-2026-18360 Malicious code in itsa-react-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64de48442d38106cf6ce795da22aab4b4ec88546cce9d63883761e944f41c445 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in itsa-react-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64de48442d38106cf6ce795da22aab4b4ec88546cce9d63883761e944f41c445 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ghostlock-s26

GhostLock CVE-2026-43499 for the Galaxy S26 CVE-2026-43499 ported to the Samsung Galaxy S26 series — Android 16 / GKI 6.12. One binary, three kernel lines, dynamic parameter matching at runtime: theoretically covers the whole S26 series without per-build compilation. Most GhostLock porting effort...