Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-5450 DESCRIPTION: Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to version 2.43 with a format wid...

MSAK_Task6_Exploit_Development_Sandbox

MSAK Task 6 — Exploit Development Sandbox An isolated educati...

censys-python v2.3.0

Censys Python Library !WARNING DEPRECATION NOTICE : The Censys Search v1 and v2 APIs will be deprecated soon. Please migrate to the new Censys Platform. 📖 New API Documentation : https://docs.censys.com/reference/get-started 📦 New Python SDK : censys/censys-sdk-python 🖥️ New CLI Tool cencli:...

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments,...

terminalphone — Updated!

TerminalPhone Encrypted push-to-talk voice communication over Tor hidden services. TerminalPhone is a single, self-contained Bash script that provides anonymous, end-to-end encrypted voice and text communication between two or more parties over the Tor network. It operates as a walkie-talkie: you...

CVE-2026-34990

cve-id 捐赠 通过 PayPal 或扫描下方二维码支持本项目的维护。 ⚡ 简单使用 请仅在安全且获得授权的环境中使用此项目，例如： 本地虚拟机 Docker 容器 隔离的实验室环境 授权的渗透测试环境 示例配置： root@kitploit: git clone cd Project use python follow below Create a virtual environment python -m venv venv Activate the virtual environment macOS / Linux source venv/bin/activate Window...

prismor v1.44.0

Prismor Runtime security for Claude Code, Codex, and other AI coding agents. Prismor is highly customizable based on user's own policies. Observe or enforce mode to see agent activity in a local self-serve dashboard Website • Onboard with Skill !Trae / Tra...

redis_exploit

CVE-2025-49844 RediShell - 实验环境 一个用于测试和理解 Redis 中严重漏洞 CVE-2025-49844 RediShell 的实用实验环境。 ⚠️ 警告 本内容仅供教育用途！ 仅可在您拥有或已获得明确测试许可的系统上使用 切勿暴露到互联网 切勿在生产环境中使用 关于漏洞 CVE 编号 ：CVE-2025-49844 名称 ：RediShell CVSS 评分 ：10.0（严重） 类型 ：Lua 解释器中的释放后使用（Use-After-Free，UAF） 影响 ：远程代码执行（RCE） 发现者 ：Wiz Research Team 受影响版本...

agent-skills v0.4.0

Elastic Agent Skills Elastic Agent Skills — built by the people who built Elastic — deliver native platform expertise directly to your AI coding agent. This is the official Agent Skills library, compatible with agentic IDEs such as Cursor, GitHub Copilot, Windsurf, Gemini CLI, and more. Skills...

SNMPocalypse-Cisco-Bug-Lets-Hackers-Crash-or-Command-Devices

SNMPocalypse-Cisco-Bug-Lets-Hackers-Crash-or-Command-Devices CVE-2023-20352 是 Cisco IOS/IOS XE 的 SNMP 引擎中的一个严重堆栈溢出漏洞。远程攻击者只需发送精心构造的 SNMP 数据包，就能使系统崩溃或夺取根控制权。所有 SNMP 版本均受影响，请立即修补，否则面临完全被控风险。 作者：Mark Malllia SNMP 简介 简单网络管理协议 SNMP 是网络管理中的基础协议，使系统管理员能够监控、配置和管理网络设备。它使用端口 161（用于 SNMP 请求）和 162（用于陷阱）。SNMP...

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover 一份关于 CVE-2025-59359（Chaos-Mesh 中的一个关键 OS 命令注入漏洞）的实操取证演练。了解攻击者如何通过 GraphQL 变异劫持 Kubernetes 集群，以及如何使用 ELK 检测、分析和报告此类入侵。 作者：Mark Mallia 执行摘要 CVE-2025-59359 暴露了 Chaos-Mesh 的 Controller Manager 中存在的一个关键 OS 命令注入缺陷。该漏洞允许攻击者在 Kubernetes Pod...

threatcl v0.6.8

threatcl Threat Modeling with HCL What happened to hcltm? hcltm has been renamed to threatcl. Welcome! Overview !TIP Want to read the new documentation? Head over to threatcl.dev There are many different ways in which a threat model can be documented. From a simple text file, to more in-depth wor...

IDAssist v2.3.0

IDAssist AI-Powered Reverse Engineering Plugin for IDA Pro Author: Jason Tang Description IDAssist is an IDA Pro plugin that integrates LLM-powered analysis directly into IDA's interface, providing AI-assisted binary reverse engineering through configurable LLM providers, semantic knowledge graph...

ralph

Ralph Ralph Wiggum 自主循环技术在 Claude Code 中的一个可用实现。 背景 Anthropic 插件市场中的官方 ralph-wiggum 插件目前因 Claude Code v1.0.20（2025 年 8 月）的安全更新而无法正常工作。 该安全补丁（CVE-2025-54795）正确阻止了 $ 命令替换和多行 bash 命令，以防止命令注入攻击。然而，官方插件的命令文件包含多行 bash，从而触发此保护： root@kitploit: Error: Bash command permission check failed for pattern "..."...

CVE-2024-21262

RECORDS 仅用于 CVE 复现。 相关资源： LINK GITHUB1 GITHUB2 ISSUE 检查环境 从 https://download.docker.com/linux/static/stable/x8664/ 下载 docker-24.0.6.tgz。 root@kitploit: sudo mkdir -p /usr/local/docker-24.0.6 sudo tar -xzf docker-24.0.6.tgz -C /usr/local/docker-24.0.6 sudo ln -sf /usr/local/docker-24.0.6/docker/...

sql-injection-poc

SQL Injection PoC – gptcdharmapurico.in 🚨 LEGAL DISCLAIME...

rustinel v1.4.0

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Bring your detection content, monitor your endpoints, and send alerts to the...

Exploit for CVE-2026-19949

CVE-2026-19949 Donate Help maintain this p...

Security Bulletin:Vulnerabilities exists in callhome of IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in security patch ina-release-callhomeimage-1.0.2.3. Vulnerability Details CVEID:CVE-2022-2042 DESCRIPTION: Use After Free in GitHub repository vim/vim prior to 8.2. CWE:CWE-416: Use After Free CVSS Source: IBM X-Force...

HexWalk v2.2.0

HexWalk - Hex Editor/Viewer/Analyzer HexWalk is an Hex editor, viewer, analyzer. Built on qhexedit2, Capstone and Qt, with a built-in signature scanner, HexDig, inspired by binwalk. It is cross platform and has plenty of features: Advanced Find can find patterns in binary files based on...