hardcodes

hardcodes extract strings from source code hardcodes is a utility for searching strings hardcoded by developers in programs. It uses a modular tokenizer that can handle comments, any number of backslashes & nearly any syntax you throw at it. Yes, it is designed to process any syntax and following...

deepsecrets

OWASP DeepSecrets — a better tool for secrets scanning What is it? Another token-wasting CLI proxy to an AI API? Absolutely not! In our LLM-hype era, DeepSecrets still runs entirely on your machine — giving you great results offline, securely, and for free. So why yet another tool? Most existing...

lm-fingerprint

LM-Fingerprint Fingerprints the serving stack behind an OpenAI-compatible chat endpoint. It records tokenizer accounting, hidden template offset, validation prose, JSON/SSE shape, role acceptance, named limits, and gateway headers. It does not load weights, store API keys, or ask the model who it...

lua-ffi-libinjection

Name lua-resty-libinjection - LuaJIT FFI bindings for libinjection Status This library is in active development and is production ready Description This library provides FFI bindings for libinjection, a SQL/SQLi and XSS tokenizer and analyzer. Installation Install this library as you would any...

Tokenizer

NOTE This project was one of my earliest projects for learning more about Windows drivers. Please see Chaos-Rootkit for the complete version...

chatml-role-token-probe

chatml-role-token-probe Prove your agent stack is vulnerable to role-forgery — before an attacker does. A drop-in probe that fires a corpus of ChatML / Mistral / Llama control-token literals at your self-hosted agent stack's untrusted-text path and reports whether the tokenizer or server turns th...

CVE-2026-76077

A flaw was found in asn1scc. The XML Encoding Rules XER tokenizer does not properly enforce length bounds when copying tag data and fails to check buffer limits during input processing. A remote attacker could exploit this vulnerability by providing a crafted XER message, leading to stack memory...

CVE-2026-76077

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT in asn1crt/asn1crtencodingxer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value100 field without a length bound and reads input and lookahead bytes withou...

CVE-2026-76077 ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT in asn1crt/asn1crtencodingxer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value100 field without a length bound and reads input and lookahead bytes withou...

CVE-2026-76077 ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT in asn1crt/asn1crtencodingxer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value100 field without a length bound and reads input and lookahead bytes withou...

CVE-2026-76077

The ASN1SCC open-source ASN.1 compiler for embedded systems is vulnerable to a stack buffer overflow and out-of-bounds read in the XER tokenizer NT() function located in asn1crt/asn1crt_encoding_xer.c. This component is accessed by all XER decode paths. The root cause is the copying of tag charac...

CVE-2026-120334

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.frompretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocabfilename can lead to path traversal. The attack may be...

CVE-2026-120334

A path traversal vulnerability exists in deepset-ai farm (versions up to 0.8.0 ) within the Tokenizer Loader component. The flaw specifically affects the EmbeddingTokenizer.from_pretrained function in the farm/modeling/tokenization.py file. An attacker can manipulate the vocab_filename argument t...

CVE-2026-120334 deepset-ai farm Tokenizer Loader tokenization.py EmbeddingTokenizer.from_pretrained path traversal

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.frompretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocabfilename can lead to path traversal. The attack may be...

CVE-2026-120334 deepset-ai farm Tokenizer Loader tokenization.py EmbeddingTokenizer.from_pretrained path traversal

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.frompretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocabfilename can lead to path traversal. The attack may be...

PT-2026-135267

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab filename can lead to path traversal. The attack may be...

CVE-2026-120334: deepset-ai farm: A flaw has been found in deepset-ai farm up to 0.8.0

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.frompretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocabfilename can lead to path traversal. The attack may be...

CLEANSTART-2026-QJ34286 tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing

CVE-2025-22872 affects multiple packages. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. See references for individual vulnerability details...

CLEANSTART-2026-XS55738 tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing

CVE-2025-22872 affects multiple packages. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. See references for individual vulnerability details...

CLEANSTART-2026-MF89854 tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing

CVE-2025-22872 affects multiple packages. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. See references for individual vulnerability details...