CVE-2026-92794 OpenSign through 2.41.3 Information Disclosure via getDocument

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identit...

CVE-2026-20326

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

spectrIDA-Reverse_Engineering_Stack

👻 spectrIDA Ghost through binaries. A local, AI-powered reverse engineering assistant: parallel IDA Pro analysis, AI function naming, a terminal that doesn't suck, a Neo4j knowledge graph of everything it's ever figured out, and an MCP server so Claude can search and chain through that graph...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

holehe

Holehe OSINT - Email to Registered Accounts 👋 Hi there! For any professional inquiries or collaborations, please reach out to me at: [email protected] 📧 Preferably, use your professional email for correspondence. Let's keep it short and sweet, and all in English! Holehe Online Version Summar...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

harbian-audit

harbian-audit Hardening Introduction Hardened Debian GNU/Linux and CentOS 8 distro auditing. The main test environment is in debian GNU/Linux 9/10/11/12/13 and CentOS 8 and ubuntu 22, and other versions are not fully tested. There are no implementations of desktop related items in this release. T...

polypyus

Polypyus Firmware Historian Polypyus learns to locate functions in raw binaries by extracting known functions from similar binaries. Thus, it is a firmware historian. Polypyus works without disassembling these binaries, which is an advantage for binaries that are complex to disassemble and where...

python-haystack

python-haystack memory forensics |travis| |coverage| |landscape| |pypi| |docs| Quick Start: Quick usage guide in the docs/ folder. Haystack-reverse CLI in the docs/ folder. More documentation Introduction: python-haystack is an heap analysis framework, focused on searching and reversing of C...

openrasp

OpenRASP Introduction Unlike perimeter control solutions like WAF, OpenRASP directly integrates its protection engine into the application server by instrumentation. It can monitor various events including database queries, file operations and network requests etc. When an attack happens, WAF...

SAFE

SAFE : Self Attentive Function Embedding Paper This software is the outcome of our accademic research. See our arXiv paper: arxiv If you use this code, please cite our accademic paper as: root@kitploit: @inproceedingsmassarelli2018safe, title=SAFE: Self-Attentive Function Embeddings for Binary...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Subida de Archivos Sin Restricciones a RCE Descripción Las versiones de Bludit CMS anteriores a la 3.18.4 permiten a un atacante autenticado con un token de API válido subir archivos de cualquier tipo y extensión a través del endpoint POST /api/files/. La función...

drvtrace

tracedrv Pequeña extensión de WinDbg para rastrear transiciones desde un controlador depurado hacia otros módulos es decir, para rastrear llamadas a funciones. Uso root@kitploit: !tracedrv 4000 trace for 4000 instructions...

VMPacker

🛡️ VMPacker ARM64 ELF Virtual Machine Protection System 将 ARM64 原生指令翻译为自定义虚拟机字节码，实现函数级代码保护 Features • Architecture • Quick Start • Usage • Building • License Overview VMPacker 是一个针对 ARM64 AArch64 Linux ELF 二进制文件的虚拟机代码保护（VMP）系统。它将目标函数的原生 ARM64 指令解码为中间表示，再翻译为自定义 VM 字节码，并将嵌入式 VM 解释器注入 ELF 文件中，运行时由 VM...

ghidra-scripts

ghidra-scripts "Los humanos estamos mejor adaptados para reconocer comida que para mantener grandes grafos en la cabeza." -- Halvar Flake Una colección de mis scripts de Ghidra para facilitar la ingeniería inversa y la investigación de vulnerabilidades. Entrada del blog...

powerob

Powerob 一款即时Powershell脚本混淆工具，专为红队演练设计。因实际需求而生。 本工具仅混淆PowerShell脚本中的函数并移除注释。路线图包括混淆变量。欢迎提交拉取请求和协作。 关于 此工具源于最近一次演练中绕过端点安全的需求。在提权尝试期间，我无法下载PowerUp.ps1直到它被混淆。 技术上这是v2版本，已更新以移除注释。 安装 git clone https://github.com/cwolff411/powerob 用法 python3 powerob.py obfuscate originalfile.ps1 obfuscatedfile.ps1...

powerob

Powerob An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity. This only obfuscates functions and removes found in PowerShell scripts. Roadmap includes bfuscating variables. Pull requests and collaborative welcomed. About This was built out of the need ...

CVE-2025-55182

React2Shell PoC Este repositorio proporciona un entorno mínimo e intencionalmente vulnerable para probar escáneres de seguridad contra la reciente vulnerabilidad crítica de ejecución remota de código React2Shell que afecta a React Server Components y Next.js. CVE-2025-55182 : Existe una...

CVE-2025-7771

CVE-2025-7771 Exploit para invocar funciones arbitrarias del modo kernel desde el modo usuario abusando del controlador ThrottleStop. Demostración Referencias https://github.com/jonomango/superfetch https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/...

FindFunc

FindFunc: IDA Pro 中函数的高级筛选/搜索 FindFunc 是一款 IDA Pro 插件，用于查找包含指定汇编或字节模式、引用特定名称或字符串、或符合其他各种约束条件的代码函数。 FindFunc 在 2022 年 HexRays IDA Pro 插件大赛 中荣获第三名！ 通过规则进行筛选 FindFunc 的主要功能是让用户指定一组“规则”或约束条件，IDA Pro 中的代码函数必须满足这些条件。FF 将查找并列出所有满足 所有 规则的函数（因此目前所有规则都是 AND 连接）。例外：规则可以“反转”为否定匹配。因此，此类规则符合“AND NOT”逻辑。 FF...