tracy

Tracy A pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy can...

broadcom-wps

Broadcom 802.11 SDK Detection Toolkit This repository contains two ways to detect the presence of Broadcom's 802.11 implementation on a target router: 1. Statically using YARA rules on extracted firmware 2. Dynamically by running a fingerprinting script against a live access point The list of...

CVE-2026-26198-analysis

CVE-2026-26198 — SQL Injection in Ormar ORM A deep dive into a critical CVSS 9.8 SQL injection vulnerability in a Python async ORM, with reproduction, analysis, and fix. The Vulnerability Ormar is a popular async mini ORM for Python, commonly used with FastAPI and Starlette. Versions 0.9.9 throug...

CVE-2026-99151

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocateusb4bandwidthforstream and allocateusb4bandwidth both use ASSERTstream-sink before dereferencing stream-sink-link. ASSERT is compiled out in productio...

Devolutions Server (DVLS) — Bypassable PAM Entitlement Gate Exposes the `test-sc — Detect

Fingerprint / reachability check for Devolutions Server DVLS — Bypassable PAM Entitlement Gate Exposes the test-script PowerShell Sink: Administrator to NT AUTHORITY\SYSTEM !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Devolutions Server DVLS — Bypassable PAM Entitlement Gate Exposes...

Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE — Detect

Fingerprint / reachability check for Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE""" from kittysploit import from...

Magento CVE-2015-1397 Shoplift Detect

Fingerprints Magento and probes CmsWysiwyg/directive/index for SUPEE-5344 missing stacked SQLi sink. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1397 Shoplift SQLi surface detect.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient...

route-sixty-sink

✏️ Contributors Dillon Franke @dillonfranke Michael Maturi @a-marionette 📝 Blog https://www.mandiant.com/resources/route-sixty-sink-launch ⚓ Route Sixty-Sink Route Sixty-Sink is an open source tool that enables defenders and security researchers alike to quickly identify vulnerabilities in any .NE...

gokart

GoKart - Go Security Static Analysis GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA single static assignment form of Go source code. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe, which reduces...

CVE-2026-98926

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

MAL-2026-18179 Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

Malicious Package

Overview log-sink-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

org.apache.camel.kafkaconnector:camel-redis-sink-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:camel-redis-source-kafka-connector (4.22.0) +3 more potentially affected by CVE-2026-78165 via org.apache.camel:camel-spring-redis (>=4.19.0, <=4.22.0)

org.apache.camel:camel-spring-redis MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-78165 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429676...

org.apache.camel.kafkaconnector:camel-azure-storage-files-source-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:camel-ftp-sink-kafka-connector (4.22.0) +25 more potentially affected by CVE-2026-79985 via org.apache.camel:camel-ftp-common (>=4.19.0, <=4.22.0)

org.apache.camel:camel-ftp-common MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-79985https://vulners.com/cve/CVE-2026-7...

org.apache.camel.kafkaconnector:camel-azure-storage-files-source-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:camel-ftp-sink-kafka-connector (4.22.0) +21 more potentially affected by CVE-2026-79983 via org.apache.camel:camel-ftp (>=4.19.0, <=4.22.0)

org.apache.camel:camel-ftp MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-79983 Source advisory: SNYK:JAVA-OR...

org.apache.camel.kafkaconnector:camel-azure-storage-files-source-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:camel-ftp-sink-kafka-connector (4.22.0) +25 more potentially affected by CVE-2026-79986 via org.apache.camel:camel-ftp-common (>=4.19.0, <=4.22.0)

org.apache.camel:camel-ftp-common MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-79986https://vulners.com/cve/CVE-2026-7...

org.apache.camel.kafkaconnector:camel-azure-storage-files-source-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:camel-ftp-sink-kafka-connector (4.22.0) +25 more potentially affected by CVE-2026-79984 via org.apache.camel:camel-ftp-common (>=4.19.0, <=4.22.0)

org.apache.camel:camel-ftp-common MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-79984https://vulners.com/cve/CVE-2026-7...

org.apache.camel.kafkaconnector:camel-azure-storage-files-source-kafka-connector (4.22.0), org.apache.camel.kafkaconnector:camel-ftp-sink-kafka-connector (4.22.0) +25 more potentially affected by CVE-2026-79983 via org.apache.camel:camel-ftp-common (>=4.19.0, <=4.22.0)

org.apache.camel:camel-ftp-common MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-79983https://vulners.com/cve/CVE-2026-7...