CVE-2026-87945

The Drupal SAML SSO - Service Provider module (specifically the miniorange_saml module) is vulnerable to an Open Redirect (CWE-601) in versions 0.0.0 through 3.2.0 . The root cause is the failure to sufficiently validate certain user-supplied URLs before performing redirects. An attacker can expl...

EUVD-2026-107856

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87945 SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

maltrieve

Stories in Ready Stories in In Progress | | | || | | |/ | | \ / | | | | | | | | | \ | | / | Maltrieve Maltrieve originated as a fork of mwcrawler. It retrieves malware directly from the sources as listed at a number of sites. Currently we crawl the following: Malc0de Malware Domain List Malware...

CLEANSTART-2026-IR37926 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

red-clippy

Red Clippy Your agent tests. Red Clippy keeps the record. Open-source pentest management built to be operated by an AI agent. Connect it to Claude Code over MCP and it runs the engagement alongside you: scope and assets, recon observations, methodology coverage, and findings with CVSS and evidenc...

CVE-2026-90439

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttp...

Karma Pro 0.17

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

hobbits

About Hobbits was developed at Mahlet in 2019 as an integrated data analysis tool. It was open-sourced and is now passively maintained by Adam and anyone who wants to contribute. Join the Discord server if you want to ask questions, contribute, or just chat about binary analysis tools...

metlo

Metlo API Security Secure Your API. Metlo is an open-source API security platform Metlo is an open source API security tool you can setup in 15 minutes that inventories your endpoints, detects bad actors and blocks malicious traffic in real time. Detect API attacks in real time. Automatically blo...

jsprime

Authors Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introduction Today, more and more developers are switching to JavaScript as their first choice of language. The reason is simple JavaScript has now been started to be accepted as the mainstream programming for...

CVE-2026-76305

Splunk SOAR versions below 8.7.0 are vulnerable to an improper access control issue (CWE-862) where the system fails to verify permissions before returning an app archive. An authenticated user without the necessary permissions to view apps can download these archives, potentially exposing propri...

security-advisories

security-advisories Public security advisories published by Me Chidubem ChukwuTerminal Venom, including CVE disclosures and vulnerability reports for open-source and third-party softwares...

RSC-Scanner-POC

Next.js RSC Source Code Disclosure Scanner A security scanner for detecting CVE-2025-55183 - Next.js React Server Components RSC source code disclosure vulnerability. Description This scanner detects source code disclosure in Next.js React Server Components RSC. A malicious HTTP request sent to a...

session_reaper_lab

CVE-2025-54236 - SessionReaper Lab Docker environment for practical demonstration of CVE-2025-54236 SessionReaper: PHP Object Deserialization leading to RCE in Magento Open Source 2.4.7. Exclusive use in controlled environment. Do not run against systems without explicit authorization. About the...

DIY-CVE-2026-42945-POC

Ubuntu 22.04 + nginx 1.30.0 Docker Runtime This environment builds nginx 1.30.0 from source on Ubuntu 22.04 for local HTTP testing. PHP-FPM is configured directly in the Dockerfile because nginx.conf forwards PHP requests to /tmp/php-cgi-80.sock. Run docker compose up -d --build The compose file...

React2P4IM0Nshell

React2P4IM0Nshell 💥Extension Tool for Advanced RCE/Source Leak/Dos CVE-2025-55182/83/84 Auditing and Exploitation for Next.js and React Server Components RSC environments directly from your browser, with built-in linux terminal in the extension to receive any reverse shell ❌ ⚡ CMDCENTER: The Core...

CVE-2026-85518

A path traversal vulnerability exists in OpenSCAP during the decomposition of a Source DataStream (SDS) file. The application fails to properly validate relative file path attributes , allowing an attacker to use directory traversal sequences in a crafted datastream. By tricking a user or automat...

CVE-2026-85518 Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted...

Lilith

Lilith Free & Native Open Source C++ Remote Administration Tool for Windows Lilith is a console-based ultra light-weight RAT developed in C++. It features a straight-forward set of commands that allows for near complete control of a machine. Disclaimer The use of this software on any device that ...