dnsx

A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

refinery

Binary Refinery docs tests codecov pypi High Octane Triage Analysis || || || || || | / / / \ || ==||=====|| | / |/ \ /==| / \ ===| '======|| | \ | | \ | \ /| | || || /||/ / | | | || =========''====/=========/ /==||=====||======' \ / / Binary Refinery™ 是一系列 Python 脚本的集合，用于实现二进制数据的转换，例如压缩和加密。...

shuffledns

massDNS wrapper to bruteforce and resolve the subdomains with wildcard handling support Feature • Install • Run • Wildcard • License • Discord shuffleDNS is a wrapper around massdns, written in go, that allows you to enumerate valid subdomains using active bruteforce, as well as resolve subdomain...

sqlmap-tamper-api

SQLmap Tamper-API SQLmap 탐퍼 스크립트를 위한 API로, 탐퍼 스크립트를 작성할 때 자신이 선호하는 프로그래밍 언어를 사용할 수 있게 해줍니다. 이 API는 SQLmap이 탐퍼 스크립트를 작성할 때 Python만 허용하는 제한을 해결합니다. 작동 방식 tamper-api.py 스크립트는 페이로드 와 kwargs 를 JSON 형식 "payload": "", "kwargs": "headers": 으로 외부 탐퍼 스크립트의 STDIN에 인수로 전송합니다. 그러면 외부 스크립트가 JSON을 파싱하여 처리한 후, 다...

jfscan

!CAUTION ⚠️ Project Deprecated This project has been rewritten in Go for better performance and features. Please use the new version here: nullt3r/massmap Description Killing features Unleash the power of Nmap with Masscan for large-scale scans Scan targets using domain names and other formats...

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

SummaryThe /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters.A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in an...

BIT-OPENBAO-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Summary The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in a...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

OpenBao Agent Writes Secrets to Stdout

Impact During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in envtemplate to stdout. This primarily happens when numretries is met. This vulnerability is original to Vault and was reported via the OpenBao security mailing list. Patches Thi...

GHSA-444V-8VXR-P36H OpenBao Agent Writes Secrets to Stdout

Impact During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in envtemplate to stdout. This primarily happens when numretries is met. This vulnerability is original to Vault and was reported via the OpenBao security mailing list. Patches Thi...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the exec rendering mode during certain error conditions, specifically when numretries is met. An attacker can obtain sensitive information by accessing stdout output that may contain...

CVE-2026-93982: Insertion of Sensitive Information into Log File

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests...

CVE-2026-81320 Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

JLSEC-2026-953 ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd: pseudo-filenames e.g., fd:0, fd:1. Prior to version...

CVE-2026-16544

AWX security issue: the websocket event consumer omits RBAC checks for inventory_update_events, project_update_events, and system_job_events, allowing any authenticated user to subscribe to these unmapped groups and view real-time stdout from jobs in other organizations. Affected component is the...

CVE-2026-16544 Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...