BIT-PARSE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

airflowscan

airflowscan Checklist and tools for increasing security of Apache Airflow. DISCLAIMER This project NOT AFFILIATED with the Apache Foundation and the Airflow project, and is not endorsed by them. Contents The purpose of this project is provide tools to increase security of Apache Airflow...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

EuConform

EuConform 🇪🇺 Open-Source Evidence Toolkit For AI Compliance Open evidence format • Local bias evaluation • Schema validation • CycloneDX interoperability Offline-first • Privacy-preserving • Reusable artifacts • WCAG 2.2 AA accessible EuConform defines an open evidence format for AI compliance and...

cirro

Cirro is an extensible security research platform that enables researchers and penetration testers to collect, analyze, and visualize cloud environments and identity relationships through graph databases. Built with a modular architecture, Cirro can be extended to support multiple platforms and...

CVE-2025-30065

CVE-2025-30065 Research Notes This repository is kept intentionally small and readable. It is intended for authorized security research, local validation, and defensive study of CVE-2025-30065 in Apache Parquet / Avro schema handling. The README focuses on repository hygiene, build reproducibilit...

ecs-mapping

Corelight ECS Ingest Pipeline The repository is compromised of Ingest Pipeline files required to be used with the installer script in the repository https://github.com/corelight/ecs-templates The installer in that repository will download the files from this repository therefore using this...

CVE-2025-27407

CVE-2025-27407 GitLab Podman Lab Minimal local-only lab for proving the GitLab Direct Transfer HTTP path reaches the vulnerable graphql-ruby introspection schema loader. The lab runs one vulnerable GitLab CE container; the PoC script starts its fake GitLab source server in-process only while...

isr-sqlget

-- ISR - Infobyte Security Research -- | ISR-sqlget | www.infobytesec.com | ..:: DESCRIPTION ISR-sqlget: It's a blind SQL injection tool developed in Perl. It lets you get databases schemas and tables rows. Using a single GET/POST you can access quietly the database structure and using a single...

CVE-2026-41242

CVE-2026-41242 — protobuf.js Code Injection to RCE CVSS 9.4 Critical | Code Injection CWE-94 Overview protobuf.js npm: protobufjs versions ≤ 7.5.4 and ≤ 8.0.0 are vulnerable to arbitrary code execution via type names in the protobuf schema. The @protobufjs/codegen module concatenates type names...

CVE-2026-100354

A flaw was found in kin-openapi. The runtime schema validation lacks cycle detection when processing circular schema references. A remote attacker can exploit this vulnerability by submitting a request or response that triggers recursive validation, leading to unbounded recursion and stack...

CVE-2026-102461

A flaw was found in vertx-json-schema. When validating arrays configured with the uniqueItems keyword, the validation mechanism performs repetitive pairwise comparisons without an array size limit. A remote, unauthenticated attacker can exploit this vulnerability by submitting a crafted JSON arra...

CLSA-2026-1792161591 TuxCare security update for @nuxt/schema (1 CVE)

TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 3.12.3-tuxcare.4...

CLSA-2026-1792161590 TuxCare security update for @nuxt/schema (2 CVEs)

TuxCare rebuilt @nuxt/schema to address 2 CVEs. Fixed in 3.12.4-tuxcare.7...

CLSA-2026-1792161588 TuxCare security update for @nuxt/schema (10 CVEs)

TuxCare rebuilt @nuxt/schema to address 10 CVEs. Fixed in 4.0.3-tuxcare.4...

GraphCrawler

GraphCrawler THE GraphQL automated testing tookit Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. Version 1.2 is out!! NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e'...

sysmon-parser

sysmon-parser Automatically generated Sysmon parser for Azure Sentinel Sysmon-AllVersionsParser.txt can be loaded as a function in Azure Sentinel to parse all your events. There is an Azure Devops pipeline that triggers daily to install the latest Sysmon version, extracts the schema and populates...

quokka

Quokka image generated by DALL-E Table of Contents Introduction Installation Usage Building Documentation FAQ Introduction Quokka is a binary exporter: from the disassembly of a program, it generates an export file that can be used without the disassembler. It currently supports IDA Pro , Ghidra...

CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning

CVE-2026-21005 – Docker Registry V2 Schema 1 Image Poisoning Program Code Python Flask + Shell dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers': 'sha256:abc', 'sha256:def', 'config': ...

CVE-2026-96570

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...