lava

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

scannerl

Scannerl Scannerl is a modular distributed fingerprinting engine implemented by Kudelski Security. Scannerl can fingerprint thousands of targets on a single host, but can just as easily be distributed across multiple hosts. Scannerl is to fingerprinting what zmap is to port scanning. Scannerl wor...

malice

malice Malice's mission is to be a free open source version of VirusTotal that anyone can use at any scale from an independent researcher to a fortune 500 company. Try It Out DEMO: demo.malice.io username : malice password : ecilam Requirements Hardware 16GB disk space 4GB RAM Software Docker...

CVE-2023-27350

CVE-2023-27350 The tool is designed specifically for Massive Authentication Bypass Papecut MF/NG, which refers to a process of circumventing or bypassing authentication mechanisms on a large scale. Screenshot Requirements Python3.7+ Supported Os Linuxer Wingays Get start with $ git clone...

cve-2023-25194

Apache Druid CVE-2023-25194 CVE-2023-25194 is a deserialization vulnerability affecting Apache Kafka. This go-exploit demonstrates exploiting CVE-2023-25194 against Apache Druid using Kafka. This type of attack typically requires an LDAP JNDI attacker infrastructure that is normally spread across...

zdns

ZDNS ZDNS es un resolvedor DNS de alta velocidad y una utilidad de línea de comandos para realizar mediciones DNS a gran escala. ZDNS está escrito en Go y contiene su propio código de resolución recursiva y una caché optimizada para realizar consultas de un conjunto diverso de nombres. Usamos...

How Reliable Are NVD CWE Labels? A Large-Scale Semantic Audit with Seclometry

CWE labels in the National Vulnerability Database NVD are widely treated as ground truth for vulnerability search, scanner evaluation, benchmark construction, learning-based security tools, and vulnerability prioritization. Yet their reliability has not been systematically measured at scale,...

Malicious code in @qlik/nebula-table-utils (npm)

npm/@qlik/nebula-table-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11821 Malicious code in @servicetitan/anvil-token (npm)

npm/@servicetitan/anvil-token is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11601 Malicious code in @onereach/idw-apps (npm)

npm/@onereach/idw-apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @onereach/condition-builder (npm)

npm/@onereach/condition-builder is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/si-step-chooser (npm)

npm/@onereach/si-step-chooser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @or-sdk/idw-public (npm)

npm/@or-sdk/idw-public is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11980 Malicious code in pob-test-package-in-monorepo (npm)

npm/pob-test-package-in-monorepo is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11772 Malicious code in @ornikar/repo-config-react (npm)

npm/@ornikar/repo-config-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/idw-contracts (npm)

npm/@onereach/idw-contracts is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11664 Malicious code in @onereach/webform (npm)

npm/@onereach/webform is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11819 Malicious code in @servicetitan/anvil-react (npm)

npm/@servicetitan/anvil-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability

The Model Context Protocol MCP has rapidly established itself as a standard interface for enabling LLM-based agents to interact with external tools and services. As MCP servers are increasingly entrusted with security-sensitive operations, understanding their real-world risks has become critical...

Large Scale VPN PAN-OS Disclosure

The vulnerability of the Large Scale VPN LSVPN module of the PAN-OS operating system is related to the incorrect elimination of certain elements in the output data. Exploiting this vulnerability can allow a malicious actor to bypass existing security mechanisms remotely...