acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

Onionscan

onionscan deployment note! this repo is a patched version of https://github.com/s-rah/onionscan and is designed to be run from a google cloud shell from hunchly at https://github.com/hunchly/funchly/tree/main/onionscan which has been used as the baseline and modified to also be able to deploy on ...

InterceptSuite

InterceptSuite !IMPORTANT Este repositorio ha sido archivado. El código base activo de InterceptSuite ahora es de código cerrado y solo de pago. Consulta los detalles a continuación. Acerca de InterceptSuite fue creado para resolver un problema de larga data en las pruebas de seguridad: intercept...

Geoserver - Server-Side Request Forgery

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. id: CVE-2021-40822 info: name: Geoserver - Server-Side Request Forgery author: For3stCo1d,aringo-bf severity: high description: GeoServer through 2.18.5 and 2.19.x throug...

litellm-sqli-scanner

Escáner de inyección SQL LiteLLM CVE-2026-42208 — inyección SQL en LiteLLM Proxy Detecta y valida CVE-2026-42208: vulnerabilidad de inyección SQL en la capa de base de datos de LiteLLM Proxy. Solo para pruebas de seguridad autorizadas. Características Detección de inyección SQL CVE-2026-42208...

CVE-2025-23167

CVE-2025-23167 – Exploit de contrabando de solicitudes HTTP en Node.js Exploit funcional para CVE-2025-23167, una vulnerabilidad de contrabando de solicitudes que afecta a las versiones de Node.js 20.x anteriores a v20.19.2. Este error permite una terminación incorrecta de cabeceras HTTP, lo que...

CLEANSTART-2026-CT50806 proxy-addr is a Node

Security vulnerability affects the argo-workflows package. proxy-addr is a Node...

EUVD-2026-88568

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

EUVD-2026-88567

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-79538

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-79538

The metatool-ai MetaMCP software, specifically version 2.4.22 and below, is vulnerable to Code Execution . This vulnerability exists in the internal MCP inspector proxy endpoint at GET /mcp-proxy/server/stdio. The root cause is located within the createTransport function in the STDIO branch , spe...

EUVD-2026-89360

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

Blackash-CVE-2025-54574

🛑 CVE-2025-54574 — Desbordamiento de búfer en el montón en Squid ≤ 6.3 🛑 Severidad: Crítica CVSS 9.3 Software afectado: Squid Proxy versiones 6.3 y anteriores Tipo de vulnerabilidad: Desbordamiento de búfer basado en montón Descubierta en: procesamiento de URN Nombre Uniforme de Recurso Impacto:...

CVE-2026-102335

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

CVE-2026-102334

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102335 Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102335 Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...