ida-pro-mcp

IDA Pro MCP !IMPORTANT I recommend using theOfficial Hex-Rays IDA MCP Server instead! See the announcement blog post for more information. Simple MCP Server to allow vibe reversing in IDA Pro. https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 The binaries and prompt...

functrace

functrace - A function tracer functrace is a tool that helps to analyze a binary file with dynamic instrumentation using DynamoRIO http://dynamorio.org/. These are some implemented features based on DynamoRIO: disassemble all the executed code disassemble a specific function dump if these are...

beebug

beebug - A tool for checking exploitability Description beebug is a tool that can be used to verify if a program crash could be exploitable. This tool was presented the first time at r2con 2018 in Barcelona. Some implemented functionality are: Stack overflow on libc Crash on Program Counter Crash...

cpanel_xss_2023

About the Tool ⚒️ cpanelxss2023 is a simple Python script designed for finding CVE-2023-29489 vulnerability and exploitability in cpanel. Features ⚙️ CVE-2023-29489 Scanning: Identifies and scans for the CVE-2023-29489 vulnerability and exploitation. URL Input: Supports scanning a single URL or...

test-cve-2016-1000027

test-cve-2016-1000027 validation of the exploitability of a CVE...

Mage AI - Insecure Default Authentication Setup

A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability i...

log4j2-rce-recap

Little recap of the log4j2 remote code execution CVE-2021-44228 Requirements maven = 3 java = 8 no running ldap on 127.0.0.1:1389 Usage Build with maven. mvn test The surefire plugin will be executed two times: ExploitabilityTest proofs the expolitability of the bug. MitigationTest will be execut...

SBOM-VEX-Taint-Analysis

SBOM → VEX Agent Automatically generate signed CycloneDX VEX documents from SBOMs using a secure multi-agent AI pipeline, built in accordance with the OWASP GenAI Security Project guidelines. The Problem Generating an SBOM surfaces hundreds of CVEs. In practice, over 90% are not exploitable in a...

The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation

Web services increasingly expose backend interfaces that let users delegate tasks to AI agents, which invoke service operations directly without navigating websites. This shift changes how existing Web vulnerabilities can be exploited. We investigate these changes through VELA, an executable...

Ulysses: A Security Harness for Synthesizing Verifiable Web Exploits

How can an AI agent automatically discover security vulnerabilities in any software repository? Existing approaches use LLMs to generate software vulnerability exploits. However, it is challenging for an LLM to reliably verify its own generated exploits. In this paper, we propose Ulysses, a...

Astra Linux – Vulnerability in unbound

Before version 1.9.5, Unbound allowed an out-of-bounds write operation through a compressed name in rdatacopy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, an ongoing Unbound installation cannot be remotely or locally exploited...

tributary

Tributary A software supply chain analyzer that tells you w...

GitLab CE/EE - Remote Code Execution

GitLab CE/EE starting from 11.9 does not properly validate image files that were passed to a file parser, resulting in a remote command execution vulnerability. This template attempts to passively identify vulnerable versions of GitLab without the need for an exploit by matching unique hashes for...

CAPE - Context-Aware Prioritization Engine for Vulnerability Scoring and Management

Vulnerability patching is critical for safeguarding an enterprise's software ecosystem from cyber attacks. However, patching requires adequate preparation for potential system downtime and for unforeseen effects of the patched software on a live system. Thus, effective risk mitigation requires...

When Flaws Cascade: Understanding Vulnerabilities and Exploitation Chains in JavaScript Engines

JavaScript engines are pivotal to modern web browsers, enabling the execution of dynamic and interactive web applications. However, their complexity and widespread adoption make them prime targets for attackers exploiting vulnerabilities. While existing research has focused on detecting...

CVE-2026-96552 sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt

A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssmpro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without...

CVE-2026-92359

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...

CVE-2026-83413

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle...

EUVD-2026-79845

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-90505

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is...