DNSnitch

DNSnitch 免責事項 これは自分用に作ったもので、必要とする人がいればここに置いてあるだけです。バグを見つけたら遠慮なくIssueを開いてください！ 対話型ターミナルDNSファイアウォール DNSnitchは、ネットワークトラフィックを完全に制御できる、ローカルで動作するプライバシー最優先のDNSサーバーです。パッシブなブロックリストとは異なり、DNSnitchは「デフォルト拒否」の哲学で動作します。つまり、未知のドメインはすべてデフォルトでブロックされ、リアルタイムのターミナルダッシュボードで承認するまでアクセスできません。 主な特徴 リアルタイム傍受 :...

CVE-2026-22812

🔐 CVE-2026-22812 - OpenCode 인증되지 않은 HTTP 서버 → 원격 코드 실행 RCE CVE-2026-22812에 대한 보안 권고, 기술 분석, 탐지 지침 및 완화 노트 📌 개요 CVE-2026-22812 는 1.0.216 이전의 OpenCode 버전에 영향을 미치는 고심각도 원격 코드 실행 RCE 취약점입니다. 문제는 OpenCode가 자동으로 인증되지 않은 로컬 HTTP 서버 를 시작하며, 이 서버에 다음을 통해 액세스할 수 있다는 점에 있습니다: 로컬 악성 프로세스 허용적인 CORS를 통한 브라우저 탭...

log4j2_CVE-2021-44228

Utilizzo per il test dell'ambiente log4j2, in caso di problemi la responsabilità è personale Il mio ambiente di test è Java 17, se necessario puoi modificarlo e reimportare il progetto. Dopo aver avviato l'ambiente, l'indirizzo è: http://127.0.0.1:8006/test...

binaryninja-ollama

Binary Ninja Ollama v1.0.9 Autore: Austin Haggard Binary Ninja Ollama si integra con il tuo server ollama ospitato localmente per rinominare funzioni e variabili con l'AI Descrizione: Ollama è uno strumento che ti permette di scaricare modelli AI open source ed eseguirli localmente. Alcuni modell...

CVE-2023-45184

CVE-2023-45184 IBM i Access Client Solutions 1.1.9.4 - Lokaler Server mit defekter Zugriffskontrolle. Zeitplan Schwachstelle an den Hersteller gemeldet: 22.09.2023 Neue behobene Version 1.1.9.4 veröffentlicht: 08.12.2023 Öffentliche Offenlegung: 15.12.2023 Beschreibung IBM i Access Client Solutio...

hacker-profile

Installa le dipendenze: root@kitploit: bundle install npm i Test con server web locale: root@kitploit: $ bundle exec middleman server Compila: root@kitploit: $ gulp build $ bundle exec middleman build...

GraphSpy

GraphSpy root@kitploit: / / by RedByte1337 / / / / | | / / / \ \ \ \ \ | | \ \ \ \ | | \ \ \ | / | | | \ / \ | \ | \ /| | | /|| / / / | / /|| / /|| / विषय-सूची GraphSpy विषय-सूची त्वरित प्रारंभ स्थापना निष्पादन उपयोग विशेषताएँ रिलीज़ नोट्स आगामी विशेषताएँ प्रायोजक श्रेय त्वरित प्रारंभ...

CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...

CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

DEBIAN-CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

UBUNTU-CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-63118

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a...

CVE-2026-63118 MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a...

PYSEC-2026-3459 Anki's local HTTP server does not sufficiently validate requests

Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impact The severity varies ...

CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret process.env'NETWORKAIMCPSECRET' ?? '' at bin/mcp-server.ts:89, which causes isAuthorized lib/mcp-transport-sse.ts:254 to return true unconditionally for every reques...

GHSA-Q78P-HJ9H-5466 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

Linux Distros Unpatched Vulnerability : CVE-2026-59153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its...

CVE-2026-59153

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting...

UBUNTU-CVE-2026-58266

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and edito...