briefr

BRIEFR Self-hosted CVE intelligence for analysts who need answers, not another raw feed Live demo · Documentation · Quick start · Screenshots What is BRIEFR? BRIEFR is a self-hosted CVE intelligence dashboard. It pulls public vulnerability and threat feeds into your PostgreSQL database, then give...

openclaw

OpenClaw 🦞 — Your assistant, on your devices, in your chats...

kanidm v1.11.2

Kanidm - Simple and Secure Identity Management About Kanidm is a simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm. The goal of this project is to be a complete identity provider,...

CVE-2026-82329-poc

CVE-2026-82329 Artifactory Security Assessment Tool PoC dan alat validasi untuk mengidentifikasi instalasi JFrog Artifactory self-hosted yang terdampak CVE-2026-82329. Alat ini memvalidasi rantai autentikasi berikut: 1. Membuat join JWT HS256 menggunakan signing key default yang kosong. 2. Mengir...

CVE-2023-7028

CVE-2023-7028 Gitlab CVE-2023-7028: Account Takeover via Password Reset without user interactions A critical vulnerability in GitLab CE/EE CVE-2023-7028 can be easily exploited by attackers to reset GitLab user account passwords. While also vulnerable, users who have two-factor authentication...

onefuzz

❗ AVISO IMPORTANTE ❗ 31 de agosto de 2023. Desde septiembre de 2020, cuando OneFuzz se lanzó como código abierto por primera vez, hemos estado en un viaje para crear un orquestador de primer nivel para ejecutar fuzzers, impulsando la seguridad y la calidad en nuestros productos. Inicialmente...

gato

!WARNING Este repositorio está obsoleto y archivado Gato ha sido sustituido por Trajan , la herramienta multiplataforma de detección de vulnerabilidades y automatización de ataques en CI/CD de Praetorian. Trajan consolida las capacidades de ataque CI/CD de GitHub Actions Gato y GitLab Glato en un...

gh-hijack-runner

gh-hijack-runner A python script to create a fake GitHub runner and hijack pipeline jobs to leak CI/CD secrets. Discover more details in the following blogpost: https://www.synacktiv.com/publications/hijacking-github-runners-to-compromise-the-organization Exploitation If you can obtain a...

CVE-2026-88886

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886

A flaw was found in Renovate. The manager/gradle-wrapper module does not properly escape the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions='gradleWrapper', ..., a...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

EUVD-2026-75436

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886

Renovate (a dependency update automation tool) before 44.14.7 is affected by a command injection in the manager/gradle-wrapper module. The distributionUrl value read from a repository's gradle-wrapper.properties file is not escaped before invoking the Gradle Wrapper CLI. In self-hosted deployment...

PT-2026-89397

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

TCL-xss-Labs

XSS Lab — The Cyber Ledger 💸 If this project helps you, consider supporting it with a $10 donation to keep it growing. Link: https://rzp.io/rzp/zgkC6h5B An interactive, self-hosted XSS training platform with 33 progressively harder challenges — designed for hackers, pentesters, and developers who...

CVE-2026-87994

Open WebUI versions 0.9.5 through 0.11.1 are affected by an authorization flaw in the channel branch of chat_completion in backend/open_webui/main.py. The endpoint verified channel write access and membership for a supplied message_id but failed to confirm that the calling user was the original a...

xalgorix v4.6.72

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

Exploit for Improper Authentication in Jfrog Artifactory

CVE-2026-82329 Artifactory Security Assessment Tool PoC dan a...

CVE-2026-44506

Medplum , a developer platform for healthcare apps, had a flaw in versions 4.1.10 through 5.1.6 affecting self-hosted configurations . The /oauth2/register endpoint (OAuth dynamic registration) could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients serve...