CVE-2023-0297

CVE-2023-0297 認証なしのリモートコード実行 - PyLoad 0.5.0b3.dev31 における 免責事項：このスクリプトはシステムのセキュリティ監査のために作成されています。自分のシステム、または悪用する書面による許可を得たシステムでのみ使用してください。...

Kam1n0-Community

Что такое Kam1n0 v2?...

pySigma-backend-opensearch

pySigma OpenSearch 后端 这是 pySigma 的 OpenSearch 后端。它提供 sigma.backends.opensearch 包，包含两个后端类： OpensearchLuceneBackend - 将 Sigma 规则转换为 Lucene 查询语法 OpenSearchPPLBackend - 将 Sigma 规则转换为 PPL（管道处理语言）查询 Lucene 后端 Lucene 后端支持以下输出格式： default：纯 Lucene 语法的 OpenSearch 查询 提示： 在 Dashboard 中，您需要从 DQL 切换为 Lucene...

sigma-cli

Sigma 命令行界面 这是使用 pySigma 库来管理、列出并将 Sigma 规则转换为查询语言的 Sigma 命令行界面。 入门 安装 安装 Sigma CLI 最简单的方式是通过 pipx 或 pip 。为此，请运行以下任一命令： root@kitploit: python -m pipx install sigma-cli python -m pip install sigma-cli 在 macOS 上使用 root@kitploit: python3 -m pip install sigma-cli root@kitploit: brew install sigma-cli...

pySigma

pySigma pySigma는 Sigma 규칙을 구문 분석하고 쿼리로 변환하는 Python 라이브러리입니다. 기존 Sigma 도구 체인sigmac을 대체하며 훨씬 깔끔한 설계를 갖추고 있고 거의 완전히 테스트되었습니다. 쿼리 언어로의 변환을 지원하는 백엔드와 로그 데이터 모델에 맞게 규칙을 변환하는 처리 파이프라인은 pySigma 자체를 가볍고 공급업체 중립적으로 유지하기 위해 별도의 프로젝트로 분리되어 있습니다. 개요는 아래의 관련 프로젝트 섹션을 참조하세요. 시작하기 pySigma를 사용하려면 Python 3.10 이상이...

SpringPeace

SpringPeace SpringPeace는 CVE-2026-43499용 Android boot.img 페이로드 후보를 생성하는 GPL-3.0-or-later GUI/CLI입니다. Windows 앱은 SpringPeace 인터페이스를 사용하여 ADB를 확인하고, boot.img를 읽고, payload.so 후보를 빌드한 다음, 매니페스트 순서대로 ADB를 통해 시도합니다. SpringPeace는 CVE-2026-43499용 Android boot.img 페이로드 후보를 생성하는 GPL-3.0-or-later GUI/CLI입니다...

pig_CS4.4

참고: 보안 연구 및 학습 목적으로만 사용하시기 바랍니다. 도구를 다른 용도로 사용할 경우 모든 법적 및 연대 책임은 사용자에게 있으며, 작성자 및 게시자는 어떠한 법적 및 연대 책임도 지지 않습니다. Cobalt Strike 4.4 猪猪版 이 버전은 사전 출시 내부 테스트 버전이며, 공개 버전은 5월 말에 출시될 예정입니다 1. 숨겨진 백도어 제거 2. 인증 헤더 변경: COOKIE를 Authentication으로 변경 3. get 요청 및 POST 요청 주소 변경 4. geacon 2차 개발 버전으로 beacon을 대체하여...

PT-2026-71233

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

EUVD-2026-54577

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

UBUNTU-CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

CVE-2026-48085

OpenReception Open-Source booking software contains an unauthenticated admin account creation flaw in versions prior to 1.0.1. A POST to /setup/create-admin-account allows an unauthenticated attacker to create additional GLOBAL_ADMIN accounts without verifying that an admin already exists. The ne...

CVE-2026-71312

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-68585

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID...

EUVD-2026-52138

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-58062

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

SUSE CVE-2026-44840

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the checkUserPassword GraphQL query in Dgraph is vulnerable to DQL Dgraph Query Language injection. User-supplied password values are interpolated directly into a DQL checkpwd query via fmt.Sprintf without any escapin...

CVE-2026-47254

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

CVE-2026-65066

Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in ring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

CVE-2026-47416

CVE-2026-47416 (PraisonAI Platform) : Connected documents describe a vertical privilege-escalation flaw in PATCH /workspaces/{workspace_id}/members/{user_id}. The route uses require_workspace_member with a default min_role of “member”, allowing a Member to set another member’s role to any value (...

CVE-2026-35198

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...