openclaw

OpenClaw 🦞 — Your assistant, on your devices, in your chats OpenClaw is an open-source AI assistant that runs on your own computer and meets you in the channels you already use: Discord, iMessage, Slack, Teams, Telegram, WhatsApp, and 20+ more, plus native apps for macOS, iOS, Android, Windows, a...

briefr

BRIEFR Самостоятельно размещаемая CVE-аналитика для аналитиков, которым нужны ответы, а не очередной сырой поток данных Живое демо · Документация · Быстрый старт · Скриншоты Что такое BRIEFR? BRIEFR — это самостоятельно размещаемая панель CVE-аналитики. Она загружает публичные фиды уязвимостей и...

Reflections and Fragments: Securing LLMs against Sequential Mosaic Attacks

Self-play red-teaming improves language-model safety by pitting attacker and defender roles against each other in a zero-sum game. However, real adversaries increasingly use mosaic attacks: multi-turn sequences whose individual fragments are innocuous in isolation yet assemble into a harmful...

irdoc-app

IRDoc - 사고 대응 문서화 플랫폼 시각적 보고서 빌더, SharePoint 자동 동기화, AI 지원 요약 기능을 갖춘 타임라인 우선 IR 문서화. IRDoc란 무엇인가? IRDoc은 SOC 분석가, IR 엔지니어, MSSP를 위한 자가 호스팅 가능한 오픈 코어 사고 대응 문서화 플랫폼 입니다. 티켓 시스템, Word 문서, SharePoint 폴더를 오가며 작업하는 대신, 최초 탐지부터 최종 보고서까지 사고를 문서화할 수 있는 하나의 구조화된 작업 공간을 팀에 제공합니다. 핵심 약속: 실제로 조사하는 방식 그대로 사고를...

Exploit for CVE-2025-21065

CVE-2025-21065 A PoC for CVE-...

CVE-2023-30943

CVE-2023-30943Moodle self-xss Avertissement Tout le contenu est fourni "tel quel", sans aucune garantie, explicite ou implicite. Les auteurs déclinent toute responsabilité pour tout dommage, direct ou indirect, résultant de l'utilisation des informations ou du logiciel associé à ce dépôt. Tout le...

CVE-2026-105117 OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/realm/users. Attackers can supply subject and message fields to send phishing mail from the...

CVE-2024-36401

CVE-2024-36401 Remix de CVE-2024-36401 de Chokapikk pour permettre un comportement de type webshell dans des environnements limités. Permet également des sessions TLS auto-signées car les sessions HTTP sont un peu... Utilisation : git clone https://github.com/keelanbrady1011/CVE-2024-36401 && cd...

NPM: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

NPM: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...

the-key-ships-with-the-lock-cve-2026-82876-phison-s11-ssd-firmware-signature-bypass

CVE-2026-82876 — Обход проверки подписи прошивки Phison S11 SSD PoC Proof-of-concept для CVE-2026-82876 CVSS 3.1: 8.2 High / CVSS 4.0: 9.3 Critical, CWE-347: контроллер Phison PS3111-S11 SATA SSD проверяет RSA-подписи обновлений прошивки по открытому модулю, встроенному в сам образ прошивки , а н...

My-Exploits

My-Exploits Этот репозиторий содержит мои собственные эксплойты :...

I-know-where-your-page-lives

I-know-where-your-page-lives 나는 당신의 페이지가 어디에 사는지 안다: 최신 Windows 10 커널 난수화 무력화 - ZeroNights 2016 요구 사항 인텔 프로세서 Haswell 또는 그 이상 Windows 10 x64 사용법 ASLRSideChannelAttack.exe를 실행하여 PML4-Self-Ref 엔트리를 얻습니다. C:\Users\qa\DesktopASLRSideChannelAttack.exe + Setting thread affinity to CPU 0 + Getting all t...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

PYSEC-2026-4111 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

SummaryMissing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call.---...

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC" markers present in the...

AI-Infra-Guard v4.6.4

📖 Documentation | 🌐 🇨🇳 中文 · 🇯🇵 日本語 · 🇪🇸 Español · 🇩🇪 Deutsch · 🇫🇷 Français · 🇰🇷 한국어 · 🇧🇷 Português · 🇷🇺 Русский 🚀 AI Red Teaming Platform by Tencent Zhuque Lab A.I.G AI-Infra-Guard integrates capabilities such as ClawScanOpenClaw Security Scan, Agent Scan，AI infra vulnerability scan...

EUVD-2026-90662

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and...

CLEANSTART-2026-OR73025 tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing

Security vulnerability affects the cri-tools package. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing...

CVE-2026-103268: Missing Authorization

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and...