Kubestroyer

Kubestroyer Kubestroyer 旨在利用 Kubernetes 集群的配置错误，成为你 Kubernetes 渗透测试中的瑞士军刀。 浏览文档 » 报告 Bug · 请求功能 目录 1. 关于项目 构建工具 2. 开始使用 先决条件 安装 3. 使用方法 4. 路线图 5. 贡献 6. 许可证 7. 联系方式 关于项目 Kubestroyer 是一个用 Golang 编写的利用工具，旨在利用 Kubernetes 集群的配置错误。 该工具会扫描可能暴露的已知 Kubernetes 端口，并对其进行利用。 回到顶部 构建工具 回到顶部 开始使用...

mesh-kridik

mesh-kridik Enhance your Kubernetes service mesh security !! mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report The security checks tests are the full implementation of istio security...

CVE-2026-91087

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gfmogetodid of the file compositor/mediaobject.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may ...

CVE-2026-91086

A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmxprocess of the file filters/reframempgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The...

CVE-2026-91088

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable o...

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-91089

CVE-2026-91089 is a use-after-free vulnerability in GPAC (up to commit f1219cde), located in the function gf_node_get_name_and_id in scenegraph/base_scenegraph.c. The flaw allows a remote attacker with low complexity and no prior privileges to trigger the issue, though user interaction is require...

CVE-2026-91089 GPAC base_scenegraph.c gf_node_get_name_and_id use after free

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gfnodegetnameandid of the file scenegraph/basescenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version...

CVE-2026-91089 GPAC base_scenegraph.c gf_node_get_name_and_id use after free

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gfnodegetnameandid of the file scenegraph/basescenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version...

EUVD-2026-78315

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gfnodegetnameandid of the file scenegraph/basescenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version...

apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed

Apache Dolphinscheduler Acerca de Apache DolphinScheduler es la plataforma moderna de orquestación de datos. Ágil para crear flujos de trabajo de alto rendimiento con poco código. También proporciona una interfaz de usuario potente, dedicada a resolver dependencias complejas de tareas en el...

voltron

Voltron Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs...

voltron

Voltron Voltron es un kit de herramientas extensible para la interfaz de usuario de depuradores, escrito en Python. Su objetivo es mejorar la experiencia del usuario de varios depuradores LLDB, GDB, VDB y WinDbg permitiendo la conexión de vistas de utilidad que pueden recuperar y mostrar datos de...

scrying

NCC Group Scrying A new tool for collecting RDP, web and VNC screenshots all in one place This tool is still a work-in-progress and should be mostly usable but is not yet complete. Please file any bugs or feature requests as GitHub issues Motivation Since Eyewitness recently dropped support for R...

scrying

NCC Group Scrying Una nueva herramienta para recopilar capturas de pantalla de RDP, web y VNC en un solo lugar Esta herramienta aún está en desarrollo y debería ser mayormente utilizable, pero aún no está completa. Por favor, reporta cualquier error o solicitud de funcionalidad como issues de...

Security Bulletin: Multiple security vulnerabilities found and remediated in IBM webMethods Managed File Transfer

Summary IBM webMethods Managed File Transfer is vulnerable to multiple issues in third-party JavaScript libraries used by its web user interface. The Axios HTTP client is susceptible to prototype pollution attacks that could allow an attacker to intercept or hijack HTTP transport, and to stream...

ios11-cookie-set-expire-issue

Problema de Establecer/Caducar Cookies en iOS 11 Parece haber un problema intermitente con el establecimiento y la caducidad de cookies en las aplicaciones web de la pantalla de inicio de iOS 11. Se pueden observar dos comportamientos erróneos: Cuando se establece una cookie y luego se cierra y...

reverse-ssh

ReverseSSH 一个静态链接的 SSH 服务器，具备反向连接功能，提供简单而强大的远程访问。在 HackTheBox 挑战、CTF 或类似场景中最为有用。 已在 OSCP 考试准备过程中开发并广泛使用。 获取最新版本 功能 用 netcat 捕获反向 shell 很酷，确实如此，但谁没有因为肌肉记忆而意外地用键盘中断关闭过反向 shell 呢？除了脆弱性之外，这样的 shell 通常还缺少完全交互式访问、TAB 补全或历史记录等便利功能。 相反，你可以选择在目标上部署 轻量级 SSH 服务器 （ cmd。 对于旧版 Windows，你可以通过将 来自 OpenSSH for...

CVE-2026-91088 GPAC URL url.c gf_url_concatenate_ex heap-based overflow

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable o...

CVE-2026-91088

GPAC is affected by a heap-based buffer overflow in the gf_url_concatenate_ex function located in utils/url.c (URL Handler component), affecting versions up to commit f1219cde. The flaw is triggered locally with low privileges and passive user interaction, leading to low impact on confidentiality...