shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

ida-pro-mcp

IDA Pro MCP ⚠️ Archived — superseded by the official Hex-Rays IDA MCP server This project is no longer maintained. On 2026-09-27 Hex-Rays SA released the Official IDA MCP Server and IDA Nexus. Development stopped the same day at 1.0.0a4. For current use, install theirs: uvx ida-hcli mcp install. I...

gitlab-gitea-import-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitlab-gitea-import-ssrf Write-up: https://abraxaslabs.tech/research/gitlab-gitea-import-ssrf gitlab-gitea-import-ssrf GitLab CE 19.4.1 - GitLab Inc. Gitea import calls UrlBlocker.validate! once, then for https throws...

CVE-2026-33534

CVE-2026-33534 - EspoCRM 9.3.3 Authenticated SSRF Authenticated SSRF proof-of-concept for EspoCRM 9.3.3 via alternative IPv4 loopback notation in the /api/v1/Attachment/fromImageUrl endpoint. Summary EspoCRM 9.3.3 blocks direct loopback URLs such as http://127.0.0.1/..., but the server-side fetch...

CVE-2026-129094

The @utcp/http library, prior to version 1.1.14 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a failure to properly validate the {host} placeholder in call templates, allowing remote manuals to bypass remote-loopback checks. An attacker can supply host arguments such...

EUVD-2026-125435

@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a host placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE...

gitea-git-redir-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-git-redir-ssrf Write-up: https://abraxaslabs.tech/research/gitea-git-redir-ssrf gitea-git-redir-ssrf Gitea 1.27.3 - Gitea IsMigrateURLAllowed is a one-shot net.LookupIP on the URL you typed. Bytes then go throug...

EUVD-2026-125172

SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebind...

CVE-2026-51585

realtek poc rt26cx21x64.sys exploit Realtek PCIe GbE/2.5GbE/5GbE family Overview OID 0xFF816871 maps the nic's mmio bar into the calling proc's virtual addr space, MmLockedPagesSpecifyCache, reachable from um via \.\RealTekCardGUID This IOCTL 0x0012C818 is gated by a registry value DrvMode=4 Once...

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

EUVD-2026-121705

pgEdge Control Plane generates pghba.conf with trust authentication for local and loopback connections...

CVE-2026-110289

A flaw was found in Grafana. This vulnerability allows an authenticated organization administrator to cause information disclosure by configuring Git Sync connection endpoints to point to loopback or internal network addresses. Under these conditions, Grafana transmits the connection credentials ...

CVE-2026-126330

Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox restart to publish the service again on a n...

npcap

Npcap Npcap is a packet capture and injection library for Windows by the Nmap Project. It is a complete update to the unmaintained WinPcap project with improved speed, reliability, and security. Documentation The complete documentation for Npcap is available in the Npcap Guide on npcap.com. There...

CVE-2026-72018

CVE-2026-72018 — Linux Kernel Out-of-Bounds Write Linux Kernel • DIBS Loopback • Out-of-Bounds Write Security research and technical analysis of CVE-2026-72018. 01 — Overview CVE-2026-72018 is a Linux kernel out-of-bounds write vulnerability affecting the DIBS/ISM loopback functionality. The...

PT-2026-145984

Attackers are spoofing the X-Gpustack-Real-IP header with 127.0.0.1 to trick GPUStack into treating external requests as trusted loopback traffic — bypassing authentication entirely without credentials. Active scanning of AI model endpoints including /v1/models and /v1/messages confirms...

CVE-2026-68507

ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard safeFetch/validateSafeUrl in src/app/lib/ssrf.t...

CVE-2026-68507 ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass

ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard safeFetch/validateSafeUrl in src/app/lib/ssrf.t...

CVE-2026-68507

The self-hosted visual workspace ideon is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 0.9.5 . The application's link-preview endpoint lacks authentication, allowing anonymous users to supply arbitrary URLs for server-side fetching. While a guard exists in src/app/lib/ssr...

EUVD-2026-124032

ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard safeFetch/validateSafeUrl in src/app/lib/ssrf.t...