EUVD-2026-81266

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values...

CVE-2026-64684

RMCP , the official Rust SDK for the Model Context Protocol, is affected in StreamableHttpClientTransport (prior to version 2.1.0). The custom_headers configured via StreamableHttpClientTransportConfig are applied to the reqwest client without being marked as sensitive. When a malicious or compro...

sobelow

Sobelow Sobelowは、ElixirおよびPhoenixフレームワーク向けのセキュリティに特化した静的解析ツールです。セキュリティ研究者にとっては、注目すべき箇所を簡単に把握できる便利なツールです。プロジェクトメンテナにとっては、多くの一般的な脆弱性の導入を防ぐために使用できます。 現在、Sobelowは以下のセキュリティ問題の一部のタイプを検出します。 安全でない設定 既知の脆弱性のある依存関係 クロスサイトスクリプティング SQLインジェクション コマンドインジェクション コード実行 サービス拒否 ディレクトリトラバーサル 安全でないシリアル化...

CVE-2026-92527

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbackscontroller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

CVE-2026-81871

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-81869

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

CVE-2026-76427

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...

CVE-2026-75513

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary...

CVE-2026-62997

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedrodatasetsexperimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weightsonly=True, and user-supplied loadargs are silently dropped. On PyTorch versions...

Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467

Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467 Apache OFBiz is an open source enterprise resource planning system. It provides a suite of enterprise applications that integrate and automate many of the business processes of an enterprise. CVE-2023-49070 is a...

ipa-medit

ipa-medit Ipa-medit is a memory search and patch tool for resigned ipa without jailbreaking. It supports iOS apps running on iPhone and Apple Silicon Mac. It was created for mobile game security testing. Many mobile games have jailbreak detection, but ipa-medit does not require jailbreaking, so...

falco

Falco Falco 是一款面向 Linux 操作系统的云原生运行时安全工具。它旨在实时检测异常行为和潜在安全威胁，并发出告警。 其核心是，Falco 是一个内核监控与检测代理，根据自定义规则观察事件（如系统调用）。Falco 可以通过集成来自容器运行时和 Kubernetes 的元数据来增强这些事件。收集到的事件可以在 SIEM 或数据湖系统中进行主机外分析。 Falco 最初由 Sysdig 创建，是 云原生计算基金会 CNCF 下的一个毕业项目 ，被众多组织用于生产环境。 有关 Falco 可检测的网络威胁的详细技术信息和见解，请访问官方 Falco 网站。...

x18-leak

x18-leak iOS 11.2 introduced a kernel information leak that could be used to determine the kASLR slide. The issue was the result of a newly added feature, ARMKERNELPROTECT, that inadvertently caused the address of the kernel function Lel0synchronousvector64long to appear in register x18 when...

CVE-2024-53677

CVE-2024-53677 - Apache Struts 2 Remote Code Execution Vulnerability RCE Reproduction Environment This repository provides a container-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2. This vulnerability involves path traversal and allows for arbitrary code...

magescan

Mage Scan The idea behind this is to evaluate the quality and security of a Magento site you don't have access to. The scenario when you're interviewing a potential developer or vetting a new client and want to have an idea of what you're getting into. Installation .phar Download the magescan.pha...

Scavenger

Scavenger - OSINT Bot - REWORKED bot in action Intro Just the code of my OSINT bot searching for sensitive data leaks on paste sites. Search terms: credentials private RSA keys Wordpress configuration files MySQL connect strings onion links SQL dumps API keys complete emails Search terms can be...

BurpBounty

Burp Bounty Free - Scan Check Builder BApp Store This Burp Suite extension allows you, in a quick and simple way, to improve the active and passive burpsuite scanner by means of personalized rules through a very intuitive graphical interface. Through an advanced search of patterns and an...

ubertooth

Ubertooth Ubertooth 项目是一个开源无线开发平台，适用于蓝牙实验。Ubertooth 自带功能强大的 BLE（Bluetooth Smart）嗅探器，并且可以嗅探 Basic Rate BR 蓝牙经典连接的部分数据。 最新版本为 2020-12-R1。 最新固件构建可在发布页面找到。 此版本与 libbtbb 2020-12-R1 配套发布。 刷写固件的说明可在相应的 readthedocs.io 固件页面找到。 构建 libbtbb 的说明可在相应的 readthedocs.io buildguide 页面找到。 文档 Ubertooth 的文档可在 Read the...

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario-

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario- A MediaTek modem input validation issue can cause a system crash remote DoS when a UE connects to a rogue base station controlled by an attacker with no user interaction required. The provided check.sh code is used to: 1...