GitLeaks

GitLeaks Container Image Opinionated gitleaks build for secret scanning in local workflows and pipelines. Features Builds gitleaks from the tagged upstream source with pinned Go toolchains for reproducible binaries. GitLab CI Component at niclas-zone/ci/gitleaks. Usage Pull the image podman pull...

redamon

Unmask the hidden before the world does RedAmon is an open-source, self-hosted AI penetration testing framework that maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens pull requests that fix what it finds. From first packet to...

cicd-sensor

🚧 Pre-release: Active development. cicd-sensor is currently in pre-release and under active development. Feedback is very welcome. cicd-sensor Think EDR, but for CI/CD Pipelines. Open-source eBPF-powered runtime security sensor for GitHub Actions and GitLab CI/CD. → Full documentation Demo ---...

Dependency Scanning

Component for Dependency and License Scanning This component generates a CycloneDX Software Bill of Materials, which is used by GitLab to identify a project's dependencies, and their licenses. This CycloneDX Software Bill of Materials is compatible with the GitLab taxonomy. Additionally, this...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

gowitness

gowitness A golang, web screenshot utility using Chrome Headless. introduction gowitness is a website screenshot utility written in Golang, that uses Chrome Headless to generate screenshots of web interfaces using the command line, with a handy report viewer to process results. Both Linux and mac...

reconness

ReconNess Web App Why ReconNess? Well, we have seen a lot of bugbounty hackers organizing his recon using txt and doing a lot of bash scripts to filter the output to keep everything organized with the intention to focus only on the potentially vulnerable targets. But realistically this demands a...

metasploit_in_termux

Metasploit Framework 6 in Termux How to Install Before In order to have updated Termux: Purge all data of Termux in Android Settings Uninstall and reinstall latest Termux version from F-Droid Version on Play Store is outdated Then launch Termux to initialization, close it force stop, not swap...

glue

OWASP Glue Glue is a framework for running a series of tools. Generally, it is intended as a backbone for automating a security analysis pipeline of tools. Recommended Usage For those wishing to run Glue, we recommend using the docker image because it should have the other tools it uses available...

Open WebUI < 0.9.5 - Information Disclosure

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...

json-sanitizer

json-sanitizer Given JSON-like content, The JSON Sanitizer converts it to valid JSON. Getting Started - Contact This can be attached at either end of a data-pipeline to help satisfy Postel's principle: be conservative in what you do, be liberal in what you accept from others Applied to JSON-like...

CVE-2026-69836-EXP

CVE-2026-69836 Entra ID Unauthenticated RCE Proof of Concept Overview CVE-2026-69836 is a critical unauthenticated remote code execution vulnerability in Microsoft Entra ID due to improper deserialization of untrusted data CWE-502. The flaw allows attackers to execute arbitrary code over the...

SharpCollection

SharpCollection Nightly builds of common C offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines. Is your favorite tool missing? Feel free to open an issue or DM me on X @Flangvik Please note that Cobalt Strike's...

cli

Getting started with the Snyk CLI Introduction to the Snyk CLI Snyk is a developer-first, cloud-native security tool to scan and monitor your software development projects for security vulnerabilities. Snyk scans multiple content types for security issues: Snyk Open Source: Find and automatically...

tenzir

Data Pipelines for Security Teams Collect, transform, enrich, and route your telemetry—all in one place. What is Tenzir? Tenzir is the data pipeline engine for security teams. If you need to collect, parse, shape, normalize, aggregate, store, query, and route security telemetry data at scale,...

GHSA-8FMV-6RG5-5924 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file,...

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file,...

EUVD-2026-113219

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory...

Rubrics-as-an-Attack-Surface

Rubrics as an Attack Surface: Stealthy Preference Drift in LLM Judges 📊 Dataset • 🤖 Trained Models • 📝 Paper • 💻 Repo This repository contains code for the paper Rubrics as an Attack Surface: Stealthy Preference Drift in LLM Judges by Ruomeng Ding, Yifei Pang, He Sun, Yizhong Wang, Steven Wu, and...