pbtk

pbtk - Ingeniería inversa de aplicaciones Protobuf Protobuf es un formato de serialización desarrollado por Google y utilizado en un número creciente de aplicaciones Android, web, de escritorio y más. Consiste en un lenguaje para declarar estructuras de datos , que luego se compila a código u otr...

graphicator

Graphicator Graphicator es un "scraper" / extractor de GraphQL. La herramienta itera sobre el documento de introspection devuelto por el endpoint de GraphQL objetivo, y luego reestructura el esquema en una forma interna para poder recrear las consultas soportadas. Cuando se crean dichas consultas...

polaris

Polaris es un motor de políticas de código abierto para Kubernetes Polaris es un motor de políticas de código abierto para Kubernetes que valida y repara la configuración de los recursos. Incluye más de 30 políticas de configuración integradas, así como la capacidad de crear políticas...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

ecs-templates

Overview This repository contains everything necessary to convert Corelight or Zeek Logs into the Elastic Common Schema ECS naming standard and store them into an Elastic Stack deployment. Originally released in 2019, the same year as Elastic Common Schema, this repository is stil actively...

EuConform

EuConform 🇪🇺 Open-Source Evidence Toolkit For AI Compliance Open evidence format • Local bias evaluation • Schema validation • CycloneDX interoperability Offline-first • Privacy-preserving • Reusable artifacts • WCAG 2.2 AA accessible EuConform defines an open evidence format for AI compliance and...

isr-sqlget

-- ISR - Infobyte Security Research -- | ISR-sqlget | www.infobytesec.com | ..:: DESCRIPTION ISR-sqlget: It's a blind SQL injection tool developed in Perl. It lets you get databases schemas and tables rows. Using a single GET/POST you can access quietly the database structure and using a single...

cirro-azcli-ext

cirro-azcli-ext An Azure CLI extension that passively collects Azure resource data into a SQLite database compatible with Cirro https://github.com/bishopfox/cirro schema. It also logs all CLI invocations to a JSON-lines file. Hooks into knack events: EVENTINVOKERPOSTPARSEARGS — logs command...

GraphQLmap

GraphQLmap GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. Install Features and examples Dump a GraphQL schema Interact with a GraphQL endpoint Execute GraphQL queries Autocomplete queries GraphQL field fuzzing Example 1 - Bruteforce a character Examp...

CVE-2025-30065

Notas de investigación CVE-2025-30065 Este repositorio se mantiene intencionalmente pequeño y legible. Está pensado para investigación de seguridad autorizada, validación local y estudio defensivo de CVE-2025-30065 en el manejo de esquemas de Apache Parquet / Avro. El README se centra en la higie...

batchql

BatchQL BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet,...

SuiteCRM Unauthenticated Graphql Introspection

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...

airflowscan

airflowscan Checklist and tools for increasing security of Apache Airflow. DISCLAIMER This project NOT AFFILIATED with the Apache Foundation and the Airflow project, and is not endorsed by them. Contents The purpose of this project is provide tools to increase security of Apache Airflow...

airflowscan

airflowscan Lista de verificación y herramientas para aumentar la seguridad de Apache Airflow. AVISO Este proyecto NO ESTÁ AFILIADO con la Apache Foundation ni con el proyecto Airflow, y no cuenta con su respaldo. Contenido El propósito de este proyecto es proporcionar herramientas para aumentar ...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

CVE-2026-34308

CVE-2026-34308: MySQL Server JSON component denial of service Official vendor bulletin: Oracle Critical Patch Update Advisory — April 2026. Summary from published CVE Vulnerability in Oracle MySQL Server component: Server: JSON. Supported affected versions: 8.0.0–8.0.45 , 8.4.0–8.4.8 , and...

CVE-2026-27553

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

EUVD-2026-80236

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

CVE-2026-27553

CVE-2026-27553 affects a web application with a diagnostics tab endpoint (/index.php/diagnostics_tab/ajax_diag_table_rows). A low-privileged remote attacker holding a valid user cookie can manipulate the schema path parameter to achieve disclosure of all user password hashes . The CNA-assigned CV...

CVE-2026-82125

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...