Burp-Encode-IP

About This extension will encode an IP address into a bunch of less known encoding techniques. This technique is focused on testing vulnerabilities such as SSRF Server-Side Request Forgery, Open Redirect or RFI Remote File Inclusion. TL;DR Easy Install If you have Burp Pro it is possible to insta...

ExtensionSpoofer

ExtensionSpoofer ExtensionSpoofer is a Visual Basic .NET desktop app that demonstrates how file names and icons can be visually manipulated on Windows while the underlying executable file type remains unchanged. It uses the Unicode Right-to-Left Override character U+202E to reverse displayed...

reverse-captcha-eval

Reverse CAPTCHA: Evaluating LLM Susceptibility to Invisible Unicode Instruction Injection An evaluation framework that tests whether large language models follow invisible Unicode-encoded instructions embedded in otherwise normal-looking text. Where traditional CAPTCHAs exploit tasks humans can...

uriDeep

uriDeep Unicode encoding attacks with machine learning. Tool based on machine learning to create amazing fake domains using confusables. Some domains can deceive IDN policies Chrome & Firefox. I created the best big dictionary of confusables using neural networks. It is used in the tool and it ca...

confusable-vision

confusable-vision The world's first font-by-font confusables dataset. Which Unicode characters look like which, measured from the fonts' outlines rather than from pixels. The current release, 2026.09.26, compares every letter and digit that each of 322 fonts draws, at the size and baseline positi...

Dagon

Dagon - Advanced Hash Manipulation Named after the prince of Hell, Dagon day-gone is an advanced hash cracking and manipulation system, capable of bruteforcing multiple hash types, creating bruteforce dictionaries, automatic hashing algorithm verification, random salt generation from Unicode to...

glassworm-hunter

glassworm-hunter Detect GlassWorm supply chain attack payloads on your machine. Scans VS Code extensions, npm packages, Python packages, and git repositories. This scanner detects the attack technique itself - invisible Unicode variation selector payloads, GlassWorm decoder patterns, C2...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

EvilURL

EvilURL v3.0 Generate unicode domains for IDN Homograph Attack and detect them. The EvilURL is released under a BSD-style license. See LICENSE for more details. CLONE git clone https://github.com/UndeadSec/EvilURL.git INSTALL pip install python-nmap python-whois RUNNING cd EvilURL python3...

RLSA-2026:85917 Moderate: perl:5.32 security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 For more details about the security issue...

Moderate: Red Hat Security Advisory: perl:5.32 security update

An update for the perl:5.32 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization

A flaw was found in the URI component for Perl. This vulnerability occurs because the nameprep function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form non-NFC can be encoded into a non-standard...

CVE-2026-99180

A flaw was found in the Linux kernel's Unicode subsystem. This issue occurs because character mapping tables used for case-insensitive file lookups are freed immediately upon unmounting a filesystem without waiting for active path lookups to complete. A local user could exploit this race conditio...

Security Bulletin: Vulnerability in setuptools affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in setuptools has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

bidi-guard

bidi-guard Scan code for invisible bidirectional Unicode characters Why This Exists Invisible Unicode bidirectional characters can make source code display differently than it executes. This is CVE-2021-42574 — the Trojan Source attack. An attacker embeds characters that reverse text direction. I...