anubis-fetch

anubis-fetch root@kitploit: $ nix run github:fzakaria/anubis-fetch -- https://lore.kernel.org/linux-mm/some-thread/T/ Un CLI rapide en Go pour récupérer des URLs derrière les murs de preuve de travail Anubis et les contrôles d'empreinte Cloudflare — résolvant le défi en interne, et ne faisant app...

kangaroo

كنغر خوارزمية بولارد كانغر Pollard's Kangaroo المُسرَّعة بواسطة GPU لحل مشكلة اللوغاريتم المنفصل للمنحنى الإهليلجي ECDLP على secp256k1. الميزات 🖥️ GPU عبر المنصات — Vulkan AMD, NVIDIA, Intel، Metal Apple Silicon، DX12 Windows عبر wgpu 🦀 Rust نقي + WGSL — لا تبعية لـ CUDA، يتم تجميع شادرات الحوسبة...

nvd

nvd مكتبة سريعة وبسيطة بلغة Go لجلب CVEs من خلاصات NVD قاعدة بيانات الثغرات الوطنية الأمريكية. التثبيت root@kitploit: go get github.com/daehee/nvd الاستخدام توفر حزمة nvd واجهة Client لجلب CVEs من خلاصات NVD الرسمية: root@kitploit: // عميل nvd مع مجلد العمل ./tmp client, err := NewClient"tmp" //...

subjs

subjs يقوم subjs بجلب ملفات JavaScript من قائمة عناوين URL أو نطاقات فرعية. يمكن أن يساعدك تحليل ملفات JavaScript في العثور على نقاط نهاية غير موثقة، أسرار، والمزيد. يُوصى باستخدامه مع gau ثم https://github.com/GerbenJavado/LinkFinder الموارد الاستخدام التثبيت الاستخدام: أمثلة: root@kitploit: $ c...

Log4jTools

Log4jTools Log4j CVE-2021-44228 조사를 위한 도구 버그 설명 및 데모 https://www.youtube.com/watch?v=0-abhd-CLwQ FetchPayload.py JNDI 조회에서 제공된 ldap 경로에서 java 페이로드 가져오기. 요구 사항: curl 시스템, requests 파이썬 예제 명령: root@kitploit: python FetchPayload.py ldap://maliciouserver:1337/path + getting object from...

ManualRsrcDataFetching

ManualRsrcDataFetching : une fonction pour remplacer les API Windows FindResource & LoadResource & LockResource & SizeofResource. Note : Payload.ico est un shellcode calc x64...

EUVD-2026-66815

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

EUVD-2026-56133

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

NPM: Ghost: Server-Side Request Forgery in Image Fetching

NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

GHSA-GCVV-72Q8-9V76 Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

CVE-2026-70591

Ghost is a Node.js content management system. From version 0.10.0 up to 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET to internal hosts; no output was returned but it could be used to probe internal ports. The issue is...

CVE-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

CVE-2026-69078

CVE-2026-69078 affects CTI-Transmute: server-side request forgery via the evaluation report PDF rendering using WeasyPrint. User-supplied Markdown renders to HTML/PDF with unrestricted URL fetches, allowing retrieval of internal network resources and local files, and potential exposure through th...

CVE-2026-42305

A flaw was found in Dulwich, a pure-Python implementation of the Git file formats and protocols. A remote attacker could exploit this vulnerability by enticing a user on a Windows system to clone or check out a specially crafted malicious Git repository. This could lead to an arbitrary file write...

CVE-2026-24234

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to denial of service and information disclosure...

CVE-2026-24234

NVIDIA TensorRT-LLM for Linux is affected by CVE-2026-24234, a vulnerability in the multimodal media fetching functions that could allow a network-accessible attacker to trigger server-side request forgery, potentially leading to denial of service and information disclosure. The NVIDIA security b...

PYSEC-2026-2650 misp-modules has nsafe remote resource fetching in expansion

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The htmltomarkdown module accepted arbitrary HTTPS URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally...

MAL-2026-10040 Malicious code in chai-as-balanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 562ae39db73c30faea0a6d84cda0fe0b68d60d7bfa863f769edcdb620e30b0a1 chai-as-balanced is a typosquat of chai-as-promised also impersonating pino via README/badges/exports that ships a remote code execution dropper...