graudit

graudit graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being...

malicious-pdf

Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...

vimana-framework

Overview Vimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to assess, fuzz, and analyze Python projects through automated and manual techniques. Core Capabilities: Vulnerability detection and...

flawfinder

About This is "flawfinder" by David A. Wheeler. Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools...

sandsifter

s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...

fuxploider

fuxploider Fuxploider is an open source penetration testing tool that automates the process of detecting and exploiting file upload forms flaws. This tool is able to detect the file types allowed to be uploaded and is able to detect which technique will work best to upload web shells or any...

A week in security (October 26 – November 1)

Last week on Malwarebytes Labs: Fake PDF and search tools hijacked searches for 13.4 million Chrome users Photo ID, bank checks, face scan? The UK’s age-check options Binance hit by largest-ever crypto theft, with $6.3 billion stolen Hackers steal and publish data on 41,000 Homeland Security...

Elastic Security Kibana Unauthorized Access

The vulnerability in the Elastic Security feature of the Kibana data visualization service is related to authorization flaws. Exploitation of this vulnerability may allow a remote attacker to gain unauthorized access to protected information...

CVE-2026-9198_exploit

CVE-2026-9198 — Langflow OSS Unauthenticated RCE Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 – 1.10.0 on a default deployment. Chains two flaws: CVE-2026-9103 — GET /api/v1/autologin mints a SUPERUSER JWT to any caller with no credentials whenever AUTOLOGIN is enabled the...

-LogicSentry-AI

LogicSentry AI LogicSentry AI is a deterministic, offline application security triage engine designed to run entirely inside your local runtime environment. It combines static application security testing SAST and dynamic application security testing DAST to isolate critical business logic...

Server Optimizer DoS

Vulnerability of the Server component: The Optimizer for Oracle Database Management System MySQL Server is affected by access control flaws. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

MySQL InnoDB DoS

The vulnerability in the InnoDB component of the Oracle MySQL Server database management system is related to access control flaws. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Oracle MySQL Server DoS

Vulnerability in the Server component: The partition of the Oracle MySQL Server database management system is affected by access control flaws. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at t...

Chrome and Firefox updates fix serious security flaws. Install now

On October 27, Google issued a new Stable channel update for Chrome. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. The update includes 52 security fixes, including four rated Critical. On...

SELinux troubleshooting system Service Conceal Security Alerts

The vulnerability in the deletealert method of the SELinux troubleshooting system service is related to authorization process flaws. Exploitation of this vulnerability could allow an attacker to conceal security alerts from administrators...

PHP 8.5.11 PHP2Shell Scanner

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain memory-handling flaws that can allow unauthenticated remote code execution. This tool sends multipart request probes and identifies susceptible targets from crash signals or the X-Powered-By version...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in jackson-databind (CVE-2026-68497)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in jackson-databind due to deserializer flaws. Jackson-databind is used in our Speech microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerabili...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:22134-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22134-1 advisory. Changes in gh: - Update to version 2.102.0, fixing four security issues GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,...

ROS-20261021-73-0044

The vulnerability in ElasticSearch is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information...