CVE-2026-77926

Aix-DB 1.2.4 is vulnerable to a remote code execution (RCE) flaw within the ChatBI common agent's ungated deepagents execute tool . This vulnerability allows authenticated non-admin users to execute arbitrary operating system commands on the host. Attackers can trigger this by sending crafted cha...

EUVD-2026-104686

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/getanswer or upload documents with maliciou...

CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the...

CVE-2026-75128

Langchain-Chatchat versions through 0.3.1.3 are vulnerable to unauthenticated Remote Code Execution (RCE) due to a missing authentication check on the POST /tools/call API endpoint. This endpoint allows the invocation of any registered tool by name; specifically, the shell tool is always register...

EUVD-2026-104685

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the...

agentic-radar

A Security Scanner for your agentic workflows! View Demo · Documentation · Report Bug · Request Feature Table of Contents 1. Description 2. Agentic Visualizer 3. Getting Started Prerequisites Installation 4. Advanced Installation CrewAI Installation OpenAI Agents Installation 5. Usage 6. Advanced...

HackBar

HackBar Burpsuite Plugin Usage Requirements Burpsuite How to Install Download Latest Jar from https://github.com/d3vilbug/HackBar/releases/ and add in burpsuite Tested on Burpsuite 2021.4 Windows 10 Ubuntu & PopOS Upcoming Features/Modules Ctrl + H shortcut WAF bypass SQLi Decoder/Encoder Greets...

PyCk

PyCk For complete details please take a look at the wiki. Installation git clone https://github.com/Naategh/PyCk.git cd PyCk pip3 install -r requirements.txt Install via docker git clone https://github.com/Naategh/PyCK.git docker build . Requirements Python 3.5 Roadmap This is an educational...

CVE-2023-45857-Demo

Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...

PipeViewer

A GUI tool for viewing Windows Named Pipes and searching for insecure permissions. The tool was published as part of a research about Docker named pipes: "Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 1" "Breaking Docker Named Pipes SYSTEMatically: Docker...

Printnightmare

Printnightmare Fix for PrintNightmare CVE-2021-34527 Run disable-spooler.ps1 file as administrator to disable spooler powershell.exe -executionpolicy bypass -file .\disable-spooler.ps1 For batch disabling, make a server list with the names of all your servers e.g. serverlist.txt and run the file...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 Joomla Unauthenticated Information Disclosure Description Supports high-concurrency detection Write url into urls.txt, only supports http://ip:port & https://ip:port format Use the -p parameter to add a proxy Just run Usage Help .\CVE-2023-23752.exe -h ██████╗██╗...

TerraformGoat

TerraformGoat English | 中文 TerraformGoat is HXSecurity research lab's "Vulnerable by Design" multi cloud deployment tool. Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure. 🎯 Scenarios ID| Cloud Servic...

BlueTeam-Tools

BlueTeam-Tools This github repository contains a collection of 70+ tools and resources that can be useful for blue teaming activities. Some of the tools may be specifically designed for blue teaming, while others are more general-purpose and can be adapted for use in a blue teaming context. 🔗 If...

testssl.sh

Intro testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as some cryptographic flaws. Key features Clear output: yo...

hyperfox

Hyperfox Hyperfox is a security auditing tool that proxies and records HTTP and HTTPS traffic between two points. Installation You can install the latest version of hyperfox to /usr/local/bin with the following command requires admin privileges: curl -sL...

CVE-2022-31691

CVE-2022-31691 A write-up of my so far inconclusive look into CVE-2022-31691. Background I'm a frequent user of the Spring Tool Suite STS for Eclipse, and tend to rely on it to initialise new Spring Boot projects. This vulnerability see https://tanzu.vmware.com/security/cve-2022-31691 is an RCE...

HackBrowserData

HackBrowserData HackBrowserData is a command-line tool for decrypting and exporting browser data passwords, history, cookies, bookmarks, credit cards, download history, localStorage, sessionStorage and extensions from the browser. It supports the most popular Chromium-based browsers and Firefox o...

hcaptcha-challenger

hCaptcha Challenger 🚀 Gracefully face hCaptcha challenge with multimodal large language model. Introduction Does not rely on any Tampermonkey script. Does not use any third-party anti-captcha services. Just implement some interfaces to make AI vs AI possible. Documentation: English | 简体中文 | Русск...

dark-fantasy-hack-tool

DARK FANTASY HACK TOOL Written by @ritvikb99 and @CodesWhite and @meuzgebre Requirements file idea given by @Swastik2561 For security purposes only ! Installation: $ pipenv install or: $ pip3 install -r requirements.txt Features: DOS Tool: To take down small websites by flooding with HTTP...