CVE-Disclosures

Investigación de Seguridad y Divulgaciones de CVE🔥 Un repositorio que documenta vulnerabilidades de seguridad descubiertas en Software Libre y de Código Abierto FOSS por VETTRIVEL U Solo hay dos tipos de empresas: las que han sido comprometidas y lo saben, y las que han sido comprometidas y aún n...

CVE-2026-90603

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90602

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90603 Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90603 Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90603

CVE-2026-90603 affects Anil-matcha Open-Generative-AI versions up to 1.0.11/2.0.0 . The vulnerability resides in the S3 Upload component, specifically the /api/upload-binary endpoint, where manipulation of the x-proxy-target-url argument enables an unrestricted upload . An unauthenticated remote ...

CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90602

A cross-site scripting (XSS) vulnerability affects the renderHistory function in ImageStudio.js within the Studio Components component of Anil-matcha Open-Generative-AI (versions up to 1.0.11/2.0.0). The attack can be initiated remotely and requires low privileges and user interaction , resulting...

YARAify

YARAify YARAify es un motor abierto de escaneo y búsqueda de reglas YARA. Este repositorio proporciona algunos scripts de ejemplo en python3 sobre cómo interactuar con la API de YARAify. Obtener una clave de autenticación Auth-Key Para consultar la API de YARA, necesitas obtener una Auth-Key. Si...

CVE-2024-34328

CVE-2024-34328 基于主机头的开放重定向 📝 概述 漏洞标题 ：基于主机头的开放重定向 产品 ：Sielox AnyWare 受影响版本 ：2.1.2 CVE ID ：CVE-2024-34328 严重程度 ：中 攻击向量 ：远程 影响 ：开放重定向/钓鱼 🧨 描述 攻击者可以构造一个带有修改过的Host头的URL，指向其控制的恶意域名。当用户点击该恶意链接时，会被重定向到攻击者的域名——可能导致钓鱼 、凭证窃取 或恶意软件传播 。 此漏洞源于应用程序在重定向过程中生成绝对URL时对Host头的验证不当。 🖼️ 概念验证（PoC） 🔗 修改主机头攻击...

ThinkPHP < 3.2.4 - Remote Code Execution

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via the s parameter in index.php through the invokefunction functionality. id: CVE-2019-9082 info: name: ThinkPHP 3.2.4 - Remote Code Execution author: 0xanis severity: high description: |...

ARES

ARES™ 自主红队交战与持续安全验证平台 这一开放核心平台赋能企业红队、MSSP 和安全运营中心执行有针对性的攻击性交战、发现确定性的攻击路径，并在零附带风险的情况下持续验证防御态势。 平台展示 • 为什么选择 ARES？ • 竞争矩阵 • 架构 • MITRE 矩阵 • 快速开始 • 零信任安全 • 文档 ⚡ 执行摘要 传统渗透测试存在根本性缺陷：成本高昂、偶发、仅反映某一时点的情况，并且使组织对新增的错误配置和新兴的对手技战术一无所知。与此同时，自动化漏洞扫描器用成千上万个假设性 CVE 淹没 SOC 团队，却无法证明其可利用性或多阶段横向攻击路径。 ARES 弥合了这一差距。...

Awesome-RCE-techniques

Increíbles técnicas de RCE ¡Lista increíble de técnicas para lograr Ejecución Remota de Código RCE en varias aplicaciones! Objetivo de este proyecto El objetivo de este proyecto es proporcionar una base de conocimiento OpenSource de todas las técnicas para lograr la Ejecución Remota de Código RCE...

dwarf2json

Introduction dwarf2json is a Go utility that processes files containing symbol and type information to generate Volatility3 Intermediate Symbol File ISF JSON output suitable for Linux and macOS analysis. To build Go 1.18+ required: root@kitploit: $ go build To run: root@kitploit: $ ./dwarf2json...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics 1.7.3 - 远程代码执行利用工具 v2 针对 Open Web Analytics 1.7.3 - RCE 的有效利用工具，集成了 pentestmonkey 的 php 反弹 shell，修复了无法在缓存中找到用户的问题。 原始利用代码可在 此处 找到。 使用方式 在 php-reverse-shell.php 文件中填写攻击机 IP 和端口，然后使用 -u 参数指定目标漏洞 URL 运行 exploit.py。 root@kitploit: python3 exploit.py -u...

IBM-Security-Verify-oAuth_Token_Steal-CVE-2024-35133

IBM Security Verify Access - OAuth 流程中的开放重定向 CVE-2024-35133 目录 1. 概述 2. 详细描述 3. 概念验证 4. 解决方案 5. 披露时间线 6. 参考资料 7. 致谢 8. 法律声明 概述 版本 : 1.0 影响 : 远程攻击者可通过诱使受害者访问特制网站，利用此漏洞伪造显示 URL 并将用户重定向至恶意网站。这可能导致攻击者获取高度敏感信息或对受害者发起进一步攻击。 严重性 : NIST：高危 IBM：中危 CVSS 评分 : NIST：8.2...

privacytools.io

加密以对抗全球大规模监控。 贡献 此项目已归档。 有关更多信息，请参阅我们的 欢迎来到 Privacy Guides 文章。我们的项目现已迁移至 Privacy Guides。 对于隐私相关的网站来说，保持内容更新非常重要。请留意 此处 所列应用程序的软件更新，并关注推荐服务商的最新动态。我们尽力保持同步，但我们并非完美，互联网瞬息万变。因此，如果您发现错误，或认为某个服务商不应被收录，或缺少某个合格的服务提供商，或某个浏览器插件不再是首选，或任何其他问题，欢迎开启 讨论 或 问题 来纠正错误。 和我们聊聊吧！ 如果您想提供帮助，欢迎加入我们的休息室聊天室...

OVSwrap-CVE-2026-64531-Mitigation-Tool

Herramienta de Mitigación OVSwrap CVE-2026-64531 Un script sencillo que detecta y mitiga la vulnerabilidad OVSwrap que afecta a los módulos del kernel de Open vSwitch. Características Detecta módulos vulnerables de Open vSwitch Determina si el módulo está cargado Bloquea la carga automática Elimi...

CVE-2026-90769

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...