OFFAT

OWASP OFFAT OFFensive Api Tester — source-aware API security testing. Maps your API from code, proves source→sink paths on a code graph, executes tests with a Rust engine, and triages the results with AI. Documentation · Install · Usage · GitHub Action Authorized use only. Live runs send real...

restler-fuzzer

RESTler What is RESTler? RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service with an OpenAPI formerly Swagger specification, RESTler analyzes its...

Directus < 11.9.0 - Version Disclosure

Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus...

hush

Give your agents boundaries you can read. Get decisions you can verify. What · Quickstart · How it works · SDKs · CLI · Policies · Docs · Spec What is HushSpec? HushSpec is an open specification for the security controls an AI agent operates under. Write a policy in YAML, evaluate it in Rust,...

vex-repo-spec

VEX Repository Specification v0.1 VEX Repository Specification v0.1 1. Versioning 2. Repository Manifest 2.1 Overview 2.2 File Location 2.3 Schema 2.4 Example 2.5 Field Descriptions and Usage Notes Main Fields Versions Subfields Locations Subfields 3. Repository Structure 3.1 File Structure 3.2...

C2SP

The Community Cryptography Specification Project The Community Cryptography Specification Project C2SP is a project that facilitates the maintenance of cryptography specifications using software development methodologies, applying the successful processes of open source to specification documents...

CVE-2021-42574

CVE-2021-42574 - Code generator // Update: 05.11.2021 It's now possible to not only encode, but also decode files. Means that now files containing supported bidi chars can be translated to template files with bidi placeholders LRO, .... Generate malicious files using recently published bidi-attac...

CVE-2026-23947-PoC

Walkthrough: CVE-2026-23947 - Orval Arbitrary Code Execution This walkthrough demonstrates how an untrusted OpenAPI specification can exploit Orval to inject arbitrary code into generated clients via the x-enumDescriptions and x-enumNames fields. Prerequisites Node.js v20 or v22 npm Setup 1. Crea...

api-security-audit-action

GitHub Action: 42Crunch REST API Static Security Testing The REST API Static Security Testing action locates REST API contracts that follow the OpenAPI Specification OAS, formerly known as Swagger and runs thorough security checks on them. Both OAS v2 and v3.0.x are supported, in both JSON and YA...

CVE-2021-42694

CVE-2021-42694 Generate malicious files using recently published homoglyph-attack vulnerability, which was discovered at least in C, C++, C, Go, Python, Rust, JS, ... Cite from cve.mitre.org An issue was discovered in the character definitions of the Unicode Specification through 14.0. The...

CVE-2026-82059

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

Security Bulletin: IBM MQ Appliance is affected by multiple vulnerabilities

Summary IBM MQ Appliance has addressed multiple vulnerabilities in version 10.0.0.6. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399...

CVE-2026-18662

A flaw was found in Eclipse Jetty. When multiple security constraints are configured with identical HTTP method omission definitions and no URL patterns, the server improperly overrides earlier constraints rather than combining their rules as required by the Jakarta Servlet specification. A remot...

CVE-2026-92982 Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource CR specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressio...

CVE-2025-15703

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2025-15703

The HireZoot WordPress plugin versions prior to 4.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape one of the job specification settings before it is reflected on an admin-area settings page. This allows users with management cap...

CVE-2025-15703 WP Job Openings < 4.0.0 - Admin+ Stored XSS

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2025-15703 WP Job Openings < 4.0.0 - Admin+ Stored XSS

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

EUVD-2025-211060

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

EulerOS 2.0 SP13 : docker-runc (EulerOS-SA-2026-4042)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12...