awesome

查看我的 macOS 应用 Supercharge 提升你的 Mac 体验 我的开源工作得到了社区的支持 特别感谢： 快速远程容器构建和 GitHub Actions 运行器。 充分利用每一次对话。 AI 驱动的会议笔记、自动化和搜索。为 AI 代理提供所需上下文，让它们完成任务。 什么是 awesome 列表？ 贡献指南 创建列表 Twitter 订阅 RSS 只需输入 awesome.re 即可到达这里。查看我的 应用 并在 Twitter 上关注我。 目录 平台 编程语言 前端开发 后端开发 计算机科学 大数据 理论 书籍 编辑器 游戏 开发环境 娱乐 数据库 媒体 学习 安全...

awesome

Check out my macOS app Supercharge Elevate your Mac experience My open source work is supported by the community Special thanks to: Fast remote container builds and GitHub Actions runners. Get the most out of every conversation. AI-powered meeting notes, automations, and search. Give AI agents th...

provisioner

Provisioner Overview Provisioner is a developer-focused provisioning sidekick for single-board computers SBCs, particularly U-Boot-based platforms. It provides a self-contained environment to: Remotely access boards Automate bring-up workflows Provision kernels and root filesystems Execute flashi...

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...

GHSA-3HHW-38PF-PXJ6 NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...

EUVD-2026-64339

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely...

Flerken

Flerken Introduction Command Line Obfuscation CLOB has been proved to be a non-negligible factor in fileless malware or malicious actors that are "living off the land". With dozens of obfuscation tools seen in the wild, by contrast few proper countermeasures can be found. In this talk, we present...

HackTools

Welcome to HackTools ! Introduction — Preview — Install — Build — Support !NOTE Psst... Loved HackTools? 👀 Check out Penflow - our new security testing companion! Try it at map.penflow.sh 🚀 !NOTE Dear Users, We're excited to announce a major revamp of our app! Due to recent changes and multiple...

CMF-Watch-Pro-2-BLE-Protocol

CMF Watch Pro 2 — BLE Protocol reverse-engineered Unofficial. This document describes the Bluetooth Low Energy BLE protocol of the CMF Watch Pro 2 CMF by Nothing, reconstructed by reverse engineering for an alternative companion app. It is not affiliated with or endorsed by Nothing/CMF. Use at yo...

CVE-2018-2628-MultiThreading

WebLogic WLS Core Component Deserialization Vulnerability CVE-2018-2628 Usage: Place the 'ip:port' to be detected into the url.txt file in the same directory. Then run: Modify the thread count at line 93 of code python CVE-2018-2628-MultiThreading.py Usage: Place the 'ip:port' to be detected into...

REW-sploit

REW-sploit Need help in analyzing Windows shellcode or attack coming from Metasploit Framework or Cobalt Strike or may be also other malicious or obfuscated code? Do you need to automate tasks with simple scripting? Do you want help to decrypt MSF generated traffic by extracting keys from payload...

sandcastle

Inspired by a conversation with Instacart's @nickelser on HackerOne, I've optimised and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler. The script takes a target's name as the stem argument e.g. shopify and iterates through a file of bucket...

CVE-2024-42327

PoC for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the...

Security Bulletin: Langflow is vulnerable to authentication bypass and insufficient session expiration

Summary Langflow provides API key-based authentication for programmatic access to flow execution and MCP endpoints. The MCP HTTP API credential resolvers do not apply the same AUTOLOGIN API-key guard that all standard authenticated endpoints enforce; when Langflow is in its default AUTOLOGIN...

page_table_walk

Capture the Flag in Physical Memory You've read about paging. The diagrams make sense. Four levels, 9 bits each, page frame, offset. Sure. But then you hit a challenge that requires actually walking page tables, and you realize you don't know it. You know about it. Big difference. What worked for...

CVE-2025-64155

CVE-2025-64155: Fortinet FortiSIEM Argument Injection to Remote Code Execution Proof of concept exploit for Fortinet FortiSIEM which abuses an argument injection to write a file to gain code execution as root Blog Post Deep-dive analysis here: Horizon3.ai - CVE-2025-64155: Three Years of Remotely...

CamRaptor

CamRaptor CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain network camera credentials. Features Exploits vulnerabilities in most popular camera models such as Novo, CeNova and QSee. Optimized to exploit multiple cameras at one time from list with threadin...

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

GHSA-F833-7JW8-XWRV NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

bugbounty-cheatsheet

Bug Bounty Cheat Sheet 📚 Reference| 🔎 Vulnerabilities ---|--- Bug Bounty Platforms| XSS Books| SQLi Special Tools| SSRF Recon| CRLF Injection Practice Platforms| CSV Injection Bug Bounty Tips| LFI | XXE | RCE | Open Redirect | Crypto | Template Injection | Contributing We welcome contributions fr...