python-decompile3

|buildstatus| |Pypi Installs| |Latest Version| |Supported Python Versions| |packagestatus| .. contents:: decompyle3 Un descompilador nativo de Python para múltiples versiones y un descompilador de fragmentos. Una reescritura de uncompyle6. Di una charla sobre esto en BlackHat Asia 2024...

xencrypt

Xencrypt PowerShell crypter v 1.0 Authors Xentropy @SamuelAnttila SecForce @SECFORCELTD If you want to read about the design behind this tool and how to make your own crypter, there's an article I wrote about it here: Write a crypter in any language Note Don't be a script kiddie, I made this GPLv...

SILENTTRINITY

SILENTTRINITY SILENTTRINITY is modern, asynchronous, multiplayer & multiserver C2/post-exploitation framework powered by Python 3 and .NETs DLR. It's the culmination of an extensive amount of research into using embedded third-party .NET scripting languages to dynamically call .NET API's, a...

CVE-2024-27348

CVE-2024-27348 Para usos éticos únicamente, no se permiten actividades dañinas o maliciosas. Y es tu propia responsabilidad Puedes leer el análisis de la vulnerabilidad desde aquí: https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/ Escáner RCE de Apache HugeGraph Server...

SmmExploit

SmmExploit Este es un informe y un exploit de CVE-2021-26943, la vulnerabilidad de escalada de privilegios local de kernel a SMM en el BIOS versión 303 del ASUS UX360CA. El problema se solucionó en la versión 304. Descripción del problema Resumen El BIOS versión 303 del UX360CA tiene 3 módulos...

telegram-bot-dumper

telegram-bot-dumper Volcado fácil de todo el contenido de los bots de Telegram. Entrada : solo el token del bot. Salida : nombre e información del bot, historial de texto y medios de todos los chats, información y fotos de los usuarios del bot. Esta es una implementación en Python. 🚀 Versión rápi...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. CVE-2026-80274: Validating resolver can abort while...

clawk

Give a coding agent its own disposable Linux machine, not yours. -lightgrey Install · Quickstart · Why a VM? · How it works · Compared to · FAQ · Docs A coding agent is only useful when you let it actually do things: install packages, run the code it writes, start servers, use the network. On you...

poc-cve-collection

poc-cve-collection Poc CVE Collection 🧪 Collects CVE PoCs and backs them up to the Internet Archive when they are unavailable on GitHub. Donate Support the maintenance of this project with PayPal or by scanning the QR code below. Example CVE-2026-31431 Title crypto: algifaead - Revert to operatin...

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...

GHSA-8WPC-H4Q6-8FXV fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...

GHSA-WW5H-9M49-7XX4 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

Summary The fix for CVE-2026-34950 CVSS 9.1, released in v6.2.0 is incomplete. It adds key.trim to the PEM-detection path in src/crypto.js, but String.prototype.trim only strips characters classified as whitespace by the ECMAScript specification. The subsequent ^-anchored regex /^-----BEGIN?: RSA...

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

Summary The fix for CVE-2026-34950 CVSS 9.1, released in v6.2.0 is incomplete. It adds key.trim to the PEM-detection path in src/crypto.js, but String.prototype.trim only strips characters classified as whitespace by the ECMAScript specification. The subsequent ^-anchored regex /^-----BEGIN?: RSA...

GHSA-687G-22H4-J4W4 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...

TCASVS

Estándar de Verificación de Seguridad de Aplicaciones de Cliente Grueso de OWASP TCASVS Introducción El Estándar de Verificación de Seguridad de Aplicaciones de Cliente Grueso de OWASP TCASVS proporciona un conjunto completo de requisitos de seguridad para diseñar, construir y probar aplicaciones...

PersistBD

PersistBD Code for "Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training" Findings of EMNLP 2026. 📄 Paper · 🌐 Project page · 📦 Dataset gated A backdoor planted in a model before release is normally worn down by the benign fine-tuning a downstream developer runs. PersistBD...

GHSA-6WJP-V33H-5CVQ PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...