osint-menace

OSINT Menace オープンソース偵察コンソール ハンターのために作られ、ブラウザのためではない。 OSINT Menaceは、防御的思考プロジェクトです。 OSINT Menaceは、受動的でケース駆動型のOSINTトリアージのためのDocker化されたPython Webアプリケーションです。アナリストに、一般的なオープンソースのピボットの実行、結果のレビュー、有用な発見のみをケースに保存し、洗練されたレポートをエクスポートするためのシンプルなサイバーパンクスタイルのインターフェースを提供します。...

lapith

Lapith Lapith は、Nessus の結果をペネトレーションテスターにとってより有用な形式で表示する Python GUI ツールです。結果はホスト単位ではなく、イシュー単位で表示できます。そのため、ホストに影響を与えるすべてのイシューを報告するよりも、イシューに影響を受けるすべてのホストを報告する方が簡単です。 複数の結果ファイルを開いて個別に表示できます。開いているすべてのファイルは単一のレポートにマージでき、複数のスキャン結果を報告しやすくなります。...

mzap v2.2.1

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...

CVE-2026-88921

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-86742

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

EUVD-2026-55970

Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...

CVE-2026-73140

The CVE-2026-73140 issue affects cti-transmute: build_evaluation_report() exported evaluation reports without applying access controls to evaluation comments, allowing a user who can view a conversion to export Markdown/PDF reports containing private comments and the comment author’s name. The ro...

CVE-2026-73140 cti-transmute Evaluation Report Exports Expose Private Comments and Author Information

Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...

CVE-2026-73140 cti-transmute Evaluation Report Exports Expose Private Comments and Author Information

Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...

PT-2026-70079

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software fails to apply comment-level access-control rules during the generation of evaluation report exports. While standard comment retrieval correctly filters based on conversion...

onyx-agent

Onyx Agent v68 Multi-LLM agent framework for security testing...

CVE-2026-58375

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id...

CVE-2026-58375 JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id...

CVE-2026-58375 JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id...

VulnAnalyzer

🔍 VulnAnalyzer 2.1 A comprehensive automated vulnerability...

Exploit for Origin Validation Error in Langflow

CVE-2025-34291corssecurityscanner A lightweight Python-base...

wafuzz

wafuzz — Web Pentesting Orchestrator Interactive CLI web secu...

CVE-2026-31956

CVE-2026-31956 affects Xibo CMS prior to 4.4.1. An authenticated user can manually construct URLs to preview campaigns/regions and export saved reports belonging to other users due to an IDOR issue triggered by disableUserCheck without proper controller-level authorization. Impact is limited to u...

CVE-2026-31956: Authorization Bypass Through User-Controlled Key

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of th...