CVE-2026-108722 open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.writelogfile in oscomputeruse/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in...

CVE-2026-108722 open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.writelogfile in oscomputeruse/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in...

CVE-2026-108722

The open-computer-use project (specifically through commit 610bac8) is vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the Logger.write_log_file function within os_computer_use/logging.py, which fails to perform HTML escaping when writing transcript text into log.html...

EUVD-2026-96888

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.writelogfile in oscomputeruse/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in...

CVE-2026-108721 Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...

CVE-2026-108721

The Open Computer Use through 1.0.0 application on macOS is vulnerable to an improper case sensitivity handling flaw (CWE-178 ). This vulnerability allows local MCP callers to bypass the password-manager denylist by using case-variant bundle identifiers, such as com.1Password.1Password. A success...

EUVD-2026-96995

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...

CVE-2026-108721 Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID

Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...

salus

Salus: Guardián de la Seguridad y Protección del Código 🔍 Resumen Salus Security Automation as a Lightweight Universal Scanner, nombrado así en honor a la diosa romana de la protección, es una herramienta para coordinar la ejecución de escáneres de seguridad. Puedes ejecutar Salus en un repositor...

CVE-2026-108573 Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

CVE-2026-108573 Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

rainbowcrackalack

Rainbow Crackalack Autor: Joe Testa @therealjoetesta Acerca de Este proyecto produce código de código abierto para generar tablas arcoíris y usarlas para buscar hashes de contraseñas. Aunque la versión actual solo soporta NTLM, las futuras versiones podrían soportar MD5, SHA-1, SHA-256 y...

ator

Extensor de Obtención y Reemplazo de Tokens de Autenticación Introducción En el mundo de las pruebas de seguridad web, la automatización es clave y Burp Suite es la opción preferida. Sin embargo, para aprovechar realmente el poder de Burp para el escaneo automatizado, necesitas los complementos...

nosqlpot

NoSQL-Honeypot-Framework NoPo NoSQL-Honeypot-Framework NoPo es un honeypot de código abierto para bases de datos NoSQL que automatiza el proceso de detectar atacantes,registrar incidentes de ataque. Los motores de simulación se despliegan usando el framework twisted.Actualmente el framework tiene...

wanderer

Wanderer Wanderer es un programa de código abierto que recopila información sobre los procesos en ejecución. Esta información incluye el nivel de integridad, la presencia de AMSI como módulo cargado, si se ejecuta en 64 o 32 bits, así como el nivel de privilegios del proceso actual. Esta...

spiderfoot

SpiderFoot es una herramienta de automatización de inteligencia de código abierto OSINT. Se integra con casi todas las fuentes de datos disponibles y utiliza una variedad de métodos para el análisis de datos, facilitando la navegación de esos datos. SpiderFoot tiene un servidor web integrado para...

kodex

Kodex Community Edition - CE es un kit de herramientas de código abierto para ingeniería de privacidad y seguridad. Te ayuda a automatizar medidas de seguridad de datos y protección de datos en tus flujos de trabajo de ingeniería de datos. Ofrece la siguiente funcionalidad: Leer elementos de dato...

combobulator

Dependency Combobulator Dependency Combobulator es un framework de código abierto, modular y extensible para detectar y prevenir fugas de confusión de dependencias y posibles ataques. Esto facilita un enfoque holístico para garantizar lanzamientos de aplicaciones seguros que pueden evaluarse fren...

httptoolkit

HTTP Toolkit !HTTP Toolkit has received funding from NLnet as part of NGI Zero...

kata-containers

Kata Containers Benvenuti in Kata Containers! Questo repository è la sede del codice di Kata Containers per le release 2.0 e successive. Se volete saperne di più su Kata Containers, visitate il sito principale di Kata Containers. Introduzione Kata Containers è un progetto open source e una...