ADTrapper

ADTrapper - Plataforma de Análisis de Seguridad de Active Directory Plataforma profesional de análisis de seguridad y detección de amenazas para Active Directory Convierta los registros de autenticación de Windows en información de seguridad procesable con detección avanzada de amenazas y...

accfly

¿Qué tan segura es tu cámara de "seguridad"? Resumen ejecutivo A principios de 2020, en mi antiguo lugar de trabajo, tuve la oportunidad de participar en un evento interno estilo pwn2own. Había varios objetivos disponibles, pero el que más me interesaba era la cámara de seguridad inalámbrica...

tiktok-scraper

TikTok Scraper & Downloader 从TikTok抓取并下载有用的信息。 无需登录或密码 这不是官方API支持等。这只是一个使用TikTok Web API来抓取媒体和相关元信息的爬虫。 内容 功能 待办事项 贡献 安装 使用 在终端中 终端示例 管理下载历史 批量抓取和下载 输出文件示例 Docker 构建 运行 模块 方法 选项 使用Promise 使用事件 如何获取/设置会话值 如何访问/下载视频 输出示例 视频流方法 getUserProfileInfo getHashtagInfo getVideoMeta getMusicInfo 重要说明...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 RCE no autenticado inyección de variables de entorno en MCP stdio Ejecución remota de código no autenticada en Langflow OSS hasta 1.10.1. La lista negra de variables de entorno que protege la configuración del servidor MCP stdio DANGEROUSENVVARS omite...

tplink-smartplug

Cliente para TP-Link WiFi SmartPlug y disector de Wireshark Para conocer la historia completa, consulta Ingeniería inversa del TP-Link HS110 tplinksmartplug.py Un cliente Python para el protocolo propietario Smart Home de TP-Link que permite controlar los enchufes inteligentes WiFi TP-Link HS100,...

Vtiger CRM v7.2.0 - Directory Listing

Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication. id: CVE-2020-19363 info: name: Vtiger CRM v7.2.0 - Directory...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server RCE sin autenticación ██╗ ██╗██╗███╗ ██╗ ██████╗ ███████╗████████╗██████╗ ██║ ██║██║████╗ ██║██╔════╝ ██╔════╝╚══██╔══╝██╔══██╗ ██║ █╗ ██║██║██╔██╗ ██║██║ ███╗ █████╗ ██║ ██████╔╝ ██║███╗██║██║██║╚██╗██║██║ ██║ ██╔══╝ ██║ ██╔═══╝ ╚███╔███╔╝██║██║ ╚████║╚██████╔╝ █...

Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the execglobals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication. id: CVE-2026-0770 info: name: Langflow...

flipper-mcp

flipper-mcp A Rust MCP Model Context Protocol server that runs directly on the Flipper Zero's WiFi Dev Board v1 ESP32-S2, enabling AI agents to control a Flipper Zero over the network. What is this? This project puts an MCP server on the Flipper itself. Any MCP-compatible AI client Claude Desktop...

twint

TWINT - Twitter 情报工具 无需身份验证。无需 API。无限制。 Twint 是一个用 Python 编写的先进 Twitter 抓取工具，允许在不 使用 Twitter API 的情况下抓取 Twitter 个人资料中的推文。 Twint 利用 Twitter 的搜索运算符，让您可以抓取特定用户的推文、抓取与特定主题、话题标签和趋势相关的推文，或者从推文中筛选出 敏感 信息，如电子邮件和电话号码。我发现这非常有用，而且您也可以发挥创意，实现更多功能。 Twint 还会向 Twitter 发送特殊查询，使您能够无需 任何身份验证、API、Selenium 或浏览器模拟，即可...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

CVE-2026-22812-exploit

Herramienta de Explotación CVE-2026-22812 Kit de explotación completo para CVE-2026-22812 - RCE no autenticado en OpenCode 🎯 Descripción general La Herramienta de Explotación CVE-2026-22812 es un framework de explotación integral para la vulnerabilidad de ejecución remota de código no autenticada...

CVE-2026-25130-Cybersecurity-AI-CAI-Framework-0.5.10

CVE-2026-25130 – Inyección de Argumentos / Inyección de Comandos del Sistema Operativo en el Framework de IA de Ciberseguridad CAI – PoC Autor: Mohammed Idrees Banyamer País: Jordania GitHub: https://github.com/yourusername Instagram: @banyamersecurity Resumen Este repositorio contiene una Prueba...

CVE-2026-23744-POC

CVE-2026-23744 — RCE no autenticado en servidores MCP Prueba de concepto PoC pord3vn0mi Resumen CVE-2026-23744 es una vulnerabilidad de Ejecución Remota de Código RCE no autenticada en servidores compatibles con MCP expuestos en el puerto 6274. El endpoint /api/mcp/connect acepta un objeto...

Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Reflected XSS via a forged cursor pagination token Failure mode Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an unsigned base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the...

CVE-2026-71568 BMCtest exposes Ironic without authentication and TLS during the test

In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity...

The vulnerability of the OUD Core component of the Oracle Unified Directory application, which facilitates simplified deployment of the Oracle Fusion Middleware software. This vulnerability allows a malicious individual to gain full control over the application.

The vulnerability of the OUD Core component of the Oracle Unified Directory application, a simplified deployment solution for the Oracle Fusion Middleware software platform, is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker ...

CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

Astra Linux – Vulnerability in bind9

The code that processes control channel messages sent to named recursively calls certain functions during packet parsing. The recursion depth is limited only by the maximum acceptable packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A flaw was discovered in the handling of SMB2READ commands within the kernel’s ksmbd module. The issue arises from failing to release memory after its effective lifespan has ended. An attacker can exploit this flaw to create a denial-of-service condition on affected Linux installations...