anubis-fetch

anubis-fetch root@kitploit: $ nix run github:fzakaria/anubis-fetch -- https://lore.kernel.org/linux-mm/some-thread/T/ Una CLI rápida en Go para obtener URLs desde detrás de muros de prueba de trabajo de Anubis y comprobaciones de huella digital de Cloudflare — resolviendo el desafío en el propio...

subjs

subjs subjs 从 URL 列表或子域名中获取 JavaScript 文件。分析 JavaScript 文件可以帮助你找到未公开的端点、秘密等。 建议将其与 gau 配合使用，然后再与 LinkFinder 配合使用。 资源 用法 安装 用法： 示例： root@kitploit: $ cat urls.txt | subjs $ subjs -i urls.txt $ cat hosts.txt | gau | subjs 要显示工具的帮助信息，请使用 -h 标志： root@kitploit: $ subjs -h 标志| 描述| 示例 ---|---|--- -c|...

kangaroo

Kangaroo GPU-accelerated Pollard's Kangaroo algorithm for solving the Elliptic Curve Discrete Logarithm Problem ECDLP on secp256k1. Features 🖥️ Cross-platform GPU — Vulkan AMD, NVIDIA, Intel, Metal Apple Silicon, DX12 Windows via wgpu 🦀 Pure Rust + WGSL — no CUDA dependency, compute shaders...

nvd

nvd 一个用 Go 编写的快速、简单的库，用于从 NVD（美国国家漏洞数据库）数据源获取 CVE。 安装 root@kitploit: go get github.com/daehee/nvd 用法 nvd 包提供了一个 Client，用于从官方 NVD 数据源获取 CVE： root@kitploit: // nvd client with ./tmp working dir client, err := NewClient"tmp" // Fetch single CVE cve, err := client.FetchCVE"CVE-2020-14882" // Fetch al...

ManualRsrcDataFetching

ManualRsrcDataFetching：一个用于替代 FindResource & LoadResource & LockResource & SizeofResource Windows API 的函数。 注意：Payload.ico 是一个 x64 calc shellcode...

Log4jTools

Log4jTools Herramientas para investigar Log4j CVE-2021-44228 Explicación de la vulnerabilidad y demo https://www.youtube.com/watch?v=0-abhd-CLwQ FetchPayload.py Obtener payload de Java desde la ruta ldap proporcionada en la búsqueda JNDI. Requisitos: curl sistema, requests python root@kitploit:...

CVE-2026-86503

In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...

EUVD-2026-72519

In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...

CVE-2026-86503

In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...

CVE-2026-86503

In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...

Unity Linux 20.1050a / 20.1070a Security Update: kernel (UTSA-2026-053361)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053361 advisory. In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message requests The driver would just fetch events and...

CVE-2026-85675

OWL 's DocumentProcessingToolkit contains a server-side request forgery (SSRF) vulnerability in the extract_document_content tool. The tool fetches caller-supplied URLs without scheme, host, or IP filtering , allowing attackers to inject malicious URLs via prompt injection and cause the server to...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85667 xiaobei through 5.5.2 Unauthenticated Webhook Message Injection

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

PT-2026-85577

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

Plate: SSRF with response disclosure in DOCX image embedding

Summary @platejs/docx-io can fetch remote image URLs while converting HTML to DOCX. When an application converts attacker-controlled HTML in a server-side or privileged environment, this can cause the application environment to make unintended outbound requests and include fetched image data in t...

CVE-2026-37237

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...

EUVD-2026-66815

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...