Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Cybercriminals are hijacking artificial intelligence AI user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others. Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 includes significant modernization changes: Python 3.9+ required - Dropped support for Python 3.6, 3.7, and 3.8 attrs library removed - Data classes now use Python's built-in dataclasses module If your code imports internal classes Cell,...

CVE-2026-34038

CVE-2026-34038：Coolify 中的认证远程命令注入漏洞 此仓库包含针对 CVE-2026-34038 （Coolify 中的一个严重命令注入漏洞）的文档和分析。 摘要 Coolify 中存在一个经身份验证的远程命令注入漏洞（CWE-78），允许拥有应用程序 “写入” 权限的用户实现 远程代码执行（RCE） 并 窃取 敏感环境变量（例如数据库凭据、API 密钥），即使构建环境隔离了 Docker 套接字。 漏洞类型： CWE-78（操作系统命令注入） 严重性： 严重（CVSS 10.0） 攻击向量：...

CVE-2025-46808 Sensitive information is leaked into NeuVector’s manager container logs

An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5...

Exchange_IOC_Hunter

ExchangeIOCHunter 描述： 在 IIS 日志中搜寻 IOC - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 支持的项目： C2 IP 地址（用于扫描和利用） 文件名（在利用尝试中观察到的） 远程代码执行（RCE） 用法： root@kitploit: powershell .\ExchangeIOCHunter.ps1 更新： 随着我们的安全参与活动的推进，此仓库将使用新的 IOC 进行更新。...

CVE-2020-17519-Apache-Flink

CVE-2020-17519 Apache Flink 任意文件读取 影响范围 Apache Flink 1.5.1 1.11.2 POC /jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd 脚本使用方法 python3 CVE-2020-17519 --help 查看使用帮助 python3 CVE-2020-17519 -u http://127.0.0.1:8080 检测某个地址是否存在漏洞 python...

EUVD-2026-75158

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-85982

The Auth0 AD/LDAP Connector is affected by a stored Cross-Site Scripting (XSS) vulnerability caused by improper HTML encoding in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes—or a low-privileged local user...

Multi-Stage-Exploitation-and-Detection-Engineering-Analysis-of-CVE-2023-34362-in-MOVEit-Transfer

CVE-2023-34362 MOVEit Transfer 漏洞分析 项目概述 此仓库包含对 CVE-2023-34362 的学术技术分析，这是一个影响 MOVEit Transfer 的严重 SQL 注入漏洞。 该项目是为 CYB625 – 道德黑客与渗透测试 准备的。 重要说明 此仓库不 包含利用代码。 此处包含的代码是防御性和教育性的。它演示了如何在 SOC 风格的工作流程中从日志中检测可疑的 Web 请求和可能的 SQL 注入指示器。 仓库结构 root@kitploit: paper/ presentation/ visuals/ detection-lab/ 检测实验室...

CVE-2026-86597

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

CVE-2026-86597

Snowflake 's Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers write sensitive data—including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions —to diagnostic logs in paths where available log redaction did not cover all data types. An atta...

EUVD-2026-72672

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

evtx-baseline

evtx-baseline A repository hosting example goodware evtx logs containing sample software installation and basic user interaction Donations win10-client.tgz by @phantinuss win11-client.tgz by @frack113 win7-x86.tgz by @pH-T win2022-evtx.tgz by @Neo23x0 win2022-ad.tgz by @frack113...

third-thoughts

Terceros Pensamientos Un proyecto de investigación de Lightless Labs que estudia el comportamiento de los agentes de IA a escala mediante análisis multidisciplinario de corpus básicamente, lanzando cosas contra la pared y viendo qué se queda pegado. Nombrado a partir del concepto de Tiffany Achin...

CVE-2026-55726

CVE-2026-55726: Contenedor de Azure Blob Storage Listable Públicamente registros de dispositivos Aviso Campo| Valor ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 Medio Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0|...

masq

Sit where the model sits. See what it can see. MASQ MASQ is a local security CLI for AI agent stacks. It sits in the same seat the model sits in: it reads MCP tool catalogs, completes the MCP handshake, looks through session logs, and probes local model HTTP ports. Then it prints findings and...

CVE-2022-47966_checker

CVE-2022-47966checker 用于查找 ManageEngine CVE-2022-47966 IOC 的快速且简陋的 PowerShell 脚本。该脚本将解析 ME HTTP 访问日志中的请求。如果发现特征性的 SAML 请求，它将尝试解码并提取攻击者的有效载荷。结果写入 C:\aceresponderCVE-2022-47966checker.csv。以管理员身份运行。 公平警告：如果你有一个面向互联网的 ManageEngine 服务器，这些日志不会持续很长时间。没有 IOC 并不意味着你就安全了。检查 C:\Program...

EVTX-ATTACK-SAMPLES

Muestras EVTX de Windows 200 ejemplos de EVTX: Este es un contenedor de muestras de eventos de Windows asociados a técnicas específicas de ataque y post-explotación. Puede ser útil para: Probar tus scripts de detección basados en el análisis de EVTX Entrenar en DFIR y caza de amenazas usando...

CVE-2026-61614 SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...