Samuraizer

Samuraizer — サイバーセキュリティナレッジベースエンジン NotebookLM の強化版 — セキュリティ研究者向けに特化。 💡 Samuraizer の理由 セキュリティ研究者なら誰でも経験があります — 興味深い GitHub リポジトリ、新しい CVE の writeup、新しいエクスプロイト手法に関するブログ記事を見つける。それを WhatsApp で自分に転送する。すぐにチャットの海に埋もれる。数週間後、実際にその記事が必要になる — しかし見つからない。 もう二度と見つけられないリンクを送るのはやめましょう — Samuraizer...

Hundred OSINT

h-osint h-osint ターミナル向けのローカルファースト、キーボード駆動のOSINTワークベンチ — Neovimスタイルのキーバインド、Lua設定、12テーマ、ローカルSQLiteケース ストア。アカウント不要、クラウドバックエンド不要、テレメトリなし。 root@kitploit: kitty » h-osint リポジトリ: h-osint · バイナリ: h-osint · ウェブサイト: https://t-beckett.gitlab.io/h-osint/ h-osintは完全にあなたのマシン上で動作します。ケースノート、...

explain-my-curl

explain-my-curl explain-my-curl은 cURL 명령어가 DNS, TLS, HTTP에서 수행하는 작업을 이해할 수 있도록 도와주는 로컬 우선 CLI 도구입니다. 이 저장소는 현재 다음을 포함합니다: cURL 입력을 파싱하고 설명하는 CLI 명령어 대화형 탐색을 위한 스타터 TUI DNS, TCP 연결, TLS 핸드셰이크, 최초 응답 시간Time-to-first-byte에 대한 실행 텔레메트리 명령어 표시 및 오류 문자열에 대한 비밀 정보 삭제Secret redaction 프로토콜 투명성을 지원하는 증거 레이...

pwnproxy

CI: suite · goldens · perf-check — baseline 281.9ms / 19 pages tests/perf/baseline.json —...

resterm v1.5.6

Resterm An API-as-code workbench for the terminal. Trace and timeline view Resterm is an API client that stores requests in plain .http and .rest files that can live side by side in your repo like the rest of your code. You can use the terminal UI, or run the same files in CI with resterm run...

bramble v1.24.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

EUVD-2026-52428

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still...

bramble v1.13.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

EUVD-2026-42079

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not...

CVE-2026-49229: Insufficient Session Expiration

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

CVE-2026-23744 --- Description MCPJam inspector is a loca...

CVE-2026-33318

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user including BASIC role can escalate to ADMIN on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: POST /account/change-password has no authorization check, allowin...

CVE-2026-33318

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user including BASIC role can escalate to ADMIN on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: POST /account/change-password has no authorization check, allowin...

EUVD-2026-8905

@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode...

CVE-2026-27638

Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode OpenID, the sync API endpoints /sync/ don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budge...

CVE-2026-27638

Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode OpenID, the sync API endpoints /sync/ don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budge...

CVE-2023-29057

A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...

CVE-2023-29057

A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...

PT-2023-22115 · Xcc · Xcc

Name of the Vulnerable Software and Affected Versions: XCC affected versions not specified Description: The issue concerns a scenario where a valid XCC user's local account permissions take precedence over their active directory permissions under specific configurations, potentially leading to a...