mellon

Vulnerabilidades de OSDP que esto explota Herramienta de ataque OSDP y la palabra élfica para amigo Ataque 1: El cifrado es opcional OSDP admite, pero no exige estrictamente el cifrado. Por lo tanto, su conexión podría no estar cifrada en absoluto. El ataque 1 consiste simplemente en escuchar...

airgeddon

airgeddon This is a multi-use bash script for Linux systems to audit wireless networks. All the needed info about how to "install | use | enjoy" airgeddon is present at GitHub's Wiki. I. Content & Features Home Features Screenshots Wallpapers II. Requirements Requirements Compatibility Cards and...

peanalyzer

peanalyzer Advanced Portable Executable File Analyzer Python 3.5.2 : Tested Working Usage python peanalyzer.py --file file.exe --show all|file-path|general|dos-header|file-header|optional-header|data-directory|section-headers|imports python peanalyzer.py --file file.exe --disassemble all...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

flounder

configs/ - 可选上下文配置文件 这些 JSON 文件是可选的、不包含答案的上下文配置文件。它们不是 Flounder 产品模式，默认情况下不会被加载。它们的存在是为了让操作员在需要时，有意识地给模型提供一个针对某类目标的熟悉框架。...

POC-CVE-2025-6554

CVE-2025-6554 CVE-2025-6554 是 Chrome 的 V8（JavaScript 引擎）解释器中的一个漏洞（Hole Check：对可选链表达式中的意外变量控制不足）。POC（CVE-2025-6554-POC.JS）探索了变量使用前“Hole”验证机制中的一个缺陷，该缺陷允许读取未初始化值，而这种读取行为通常会被引用错误阻止。 root@kitploit: function leakhole let x; delete x?.y?.a; return y; let y; function pwn let hole = leakhole;...

osinteye

This will not receive any further updates. Instagram is deprecated, so I decided to just archive it. Username enumeration & reconnaisance suite Supported sites PyPI Github TestPypi About.me Instagram DockerHub Installation Clone project: root@kitploit: $ git clone...

are-you-get-tanstack-attack

Escáner de CVE de TanStack Router Una herramienta de escaneo de seguridad para detectar el CVE de TanStack Router | GHSA de TanStack Router en tus proyectos. Resumen Esta herramienta escanea tu código en busca de indicadores de la vulnerabilidad de TanStack Router CVE-2026-45321 /...

CVE-2025-6554

CVE-2025-6554 Proof of Concept ⚠️ Security Research Project - This project is intended solely for security research and educational purposes. Do not use in production environments. 📋 Project Overview CVE-2025-6554 is a critical vulnerability in the Chrome V8 engine, involving the "Temporal Dead...

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

CVE-2026-81735

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

EUVD-2026-67078

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-81735

UI-TARS-desktop (ByteDance) — the mcp-http-server package defaulted its listen address to :: when no host was supplied, binding Streamable HTTP and SSE MCP transports to every network interface. Authentication middleware was optional, and the @agent-infra/mcp-server-commands and @agent-infra/mcp-...

PT-2026-82623

Name of the Vulnerable Software and Affected Versions UI-TARS-desktop mcp-http-server version 1.2.4 prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 Description The startServer.ts file in the mcp-http-server package defaults the listen address to :: when no host is provided. This causes t...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cifs: Prevent NULL dereferencing in cifscomposemountoptions. The optional @ref parameter may contain a NULL nodename. Therefore, prevent dereferencing it in cifscomposemountoptions. Address-Coverity: 1476408 „Explicit NULL...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/panel: ili9341: fix optional regulator handling If the optional regulator lookup fails, reset the pointer to NULL. Other functions such as mipidbipoweronconditional only perform a NULL pointer check; otherwise, they will...

EUVD-2026-55606

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

Malicious code in vite-plugin-cleaner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35bc445ea196f979ad69189f4498586a09a51855b97e95dea02d01d197620237 package.json declares an optionalDependency vite-cleaning-tools pointing at github:vite-plugins/vite-cleaning-tools with no commit SHA or tag, so npm...

MAL-2026-13463 Malicious code in vite-plugin-cleaner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35bc445ea196f979ad69189f4498586a09a51855b97e95dea02d01d197620237 package.json declares an optionalDependency vite-cleaning-tools pointing at github:vite-plugins/vite-cleaning-tools with no commit SHA or tag, so npm...

EUVD-2026-53319

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...