AddUser-SAMR

AddUser-SAMR Create local administrators using the SAMR API, operating at a lower level than net.exe, PowerShell's New-LocalUser or NetUserAdd API. It requires Administrator privileges and if the user exists, it gets added to the group but the password is not updated. There are 4 implementations ...

heaphopper

heaphopper HeapHopper is a bounded model checking framework for Heap-implementations. Overview Setup sudo apt update && sudo apt install build-essential python3-dev virtualenvwrapper git clone https://github.com/angr/heaphopper.git && cd ./heaphopper mkvirtualenv -ppython3 heaphopper pip install ...

graphql-threat-matrix

GraphQL Threat Matrix Why graphql-threat-matrix? graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the...

graphql-threat-matrix

GraphQL 威胁矩阵 为什么使用 graphql-threat-matrix？ graphql-threat-matrix 专为漏洞赏金猎人、安全研究人员和黑客打造，旨在帮助发现多种 GraphQL 实现中的漏洞。 不同 GraphQL 实现如何解释和遵循 GraphQL 规范的差异，可能导致安全漏洞和独特的攻击向量。通过分析和比较不同实现中驱动安全风险的因素，GraphQL 生态系统可以做出更安全的部署决策，并共同提升所有实现的安全成熟度。 图例 ✅ - 默认启用 ⚠️ - 默认禁用 ❌ - 不支持 实现 | 验证 | 字段建议 | 查询深度限制 | 查询成本分析 | 自动持久化查询...

umap

umap - the USB host security assessment tool Based on Facedancer by Travis Goodspeed: http://goodfet.sourceforge.net/hardware/facedancer21/ Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com...

OpenSSL-1_0_1g_CVE-2015-3195

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

kitty

Introduction | Sulley: Boo? | Boo: Kitty! What is Kitty? Kitty is an open-source modular and extensible fuzzing framework written in python, inspired by OpenRCE's Sulley and Michael Eddington's and now Deja Vu Security's Peach Fuzzer . Goal When we started writing Kitty, our goal was to help us...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

openSSL_1.0.1g

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson Todos los derechos reservados. DESCRIPCIÓN El Proyecto OpenSSL es un esfuerzo colaborativo para desarrollar un conjunto de herramientas robusto, de calidad comercial, completo y ...

noise-java

Librería Noise-Java Noise-Java es una implementación en Java puro del Protocolo Noise, pensada como una implementación de referencia. El código se distribuye bajo los términos de la licencia MIT. Esta librería está escrita en Java puro, haciendo uso de la Extension de Criptografía Java JCE para...

[SECURITY] Fedora 43 Update: gvfs-1.58.4-4.fc43

The gvfs package provides backend implementations for the gio framework in GLib. It includes ftp, sftp, cifs...

The vulnerability of the `create_mad_addr_info()` function in the `drivers/infiniband/core/mad.c` file of the Linux operating system’s kernel driver for InfiniBand, which allows a hacker to cause a service failure.

The vulnerability of the createmadaddrinfo function in the drivers/infiniband/core/mad.c file of the Linux operating system’s InfiniBand driver module is related to the use of functions with non-standard implementations. Exploiting this vulnerability could allow an attacker to cause a service...

Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...

CVE-2026-58060

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-64439

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...