socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

dnsdiag

DNS Measurement, Troubleshooting and Security Auditing Toolset Have you ever wondered if your ISP is intercepting your DNS traffic? Have you noticed any unusual behavior in your DNS responses, or been redirected to the wrong address and suspected something might be off with your DNS? We offer a...

wotop

Web-On-Top-Of-Protocol WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a tool meant to...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

galah

TL;DR: Galah /ɡəˈlɑː/ - pronounced ‘guh-laa’ is an LLM-powered web honeypot designed to mimic various applications and dynamically respond to arbitrary HTTP requests. Galah supports major LLM providers, including OpenAI, GoogleAI, GCP's Vertex AI, Anthropic, Cohere, and Ollama. Unlike traditional...

Keycloak - SAML Core Package Signature Validation Flaw

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

Pritunl VPN Server 1.29.2145.25 - Username Enumeration

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint. id: CVE-2020-25200 info: name: Pritunl VPN Server 1.29.2145.25 - Usernam...

dnscrypt-autoinstall

dnscrypt-autoinstall This project has been archived, see last comment in 108. A script for installing and automatically configuring DNSCrypt on Linux-based systems. Description DNSCrypt is a protocol for securing communications between a client and a DNS resolver by encrypting DNS queries and...

GHSA-6XMV-CJR5-W3Q8 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

Summary fastapi-code-generator koxudaxi emits an operation's extra responses into the route decorator's responses=... dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation,...

fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

Summary fastapi-code-generator koxudaxi emits an operation's extra responses into the route decorator's responses=... dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation,...

CVE-2026-118468

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity XXE attacks...

CVE-2026-118468 AIS XML parsers allow external entity resolution

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity XXE attacks...

CVE-2026-118468

The CompuGroup Medical software contains XML parsers that process attacker-influenced update manifests or network responses with external entity resolution enabled. This flaw allows for XML External Entity (XXE) attacks. While the vulnerability is confirmed through multiple sources and a sighting...

CVE-2026-111452

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-111452

Apache Airflow contains a vulnerability where the secrets masker fails to redact sensitive values stored under camelCase keys (e.g., privateKey, connectionString, webhookUrl, accessKey). Because the masker only recognizes snake_case formats, these credentials remain visible in task logs , rendere...

CVE-2026-111452

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as "privateKey", "connectionString", "webhookUrl" or "accessKey" — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered...

EUVD-2026-119888

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-111452 Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...

Important: Red Hat Security Advisory: ruby security update

An update for ruby is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...