cracklord

Cracklord http://jmmcatee.github.io/cracklord/ What Is It? CrackLord is a system designed to provide a scalable, pluggable, and distributed system for both password cracking as well as any other jobs needing lots of computing resources. Better said, CrackLord is a way to load balance the resource...

hardcodes

hardcodes extract strings from source code...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

bst

Binary String Toolkit Summary The Binary String Toolkit or BST for short is a rather simple utility to convert binary strings to various formats suitable for inclusions in source codes, such as those used to develop exploits and Proof of Concepts in the security field. Features Convert and dump...

cbrutekrag

cbrutekrag Penetration tests on SSH servers using dictionary attacks. Written in C. brute krag means "brute force" in afrikáans Disclaimer This tool is for ethical testing purpose only. cbrutekrag and its owners can't be held responsible for misuse by users. Users have to act as permitted by loca...

creepy

creepy Current Version 1.1 Author Yiannis Kakavas Homepage http://www.geocreepy.com Installation Instructions See http://www.geocreepy.com Description Geolocation OSINT tool. Creepy is a geolocation OSINT tool. Gathers geolocation related information from online sources, and allows for presentati...

hakoriginfinder

hakoriginfinder Tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies. How does it work? This tool will first make a HTTP request to the hostname/URL that you provide and store the response, then it will make a request to every IP address...

CVE-2026-64607 vulnerabilities

Vulnerabilities for packages: opensearch-fips, dependency-track-apiserver, hadoop-fips, kayenta-fips, apicurio-registry, cassandra-reaper, s3proxy-fips, apache-polaris, geoserver, camunda, thingsboard, kayenta, apicurio-registry-fips, s3proxy, pinot-fips, nrjmx, jbang, apache-hop, traccar-fips,...

MINI-2XQP-2P4C-J3MM

Bulletin has no description...

GO-2026-4803 vulnerabilities

Vulnerabilities for packages: minio...

EUVD-2026-54730

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API ha...

CVE-2026-11425

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

EUVD-2025-210623

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

CVE-2026-7657 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery SSRF due to incomplete and ineffective SSRF protection enforcement...

CVE-2026-7327

An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-si...

CVE-2026-71276

The CVE affects Magistrala (formerly Mainflux) – specifically the message-readers API. The HTTP endpoint reads a query parameter named format without validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go) and the T...

CVE-2026-71233

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! $entity-terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from th...

CVE-2026-71233

CVE-2026-71233 affects InvoiceNinja v5-stable: the client portal renders the invoice/quote terms with Laravel Blade's raw output (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) and no HTML sanitization. StoreInvoiceRequest.php only strips newlines, not HTML purification. An a...

CVE-2026-55997

CVE-2026-55997 concerns Rancher where long-lived registration tokens used to authenticate nodes/agents into a downstream cluster were stored in plaintext with no expiration. The tokens could be obtained via the Rancher API, etcd, automation, or direct file access on a node and used at any time to...