Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

Hitachi Pentaho Business Analytics Server - Bypass Authorization

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. id: CVE-2022-43939 info: name: Hitachi Pentaho Business Analytics Server - Bypass Authorization author: daffainf...

fses

fses Fucking Search Engines Scraper - python library to scrap url's from search engines Search Engines we scrap root@kitploit: Ask Bing DuckDuck GO UOL Yahoo Install root@kitploit: git clone https://github.com/mthbernardes/fses.git cd fses pip install -r requeriments.txt Usage Simple search using...

Moderate: Red Hat Security Advisory: NetworkManager security update

An update for NetworkManager is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

sn0int

sn0int sn0int pronounced /snoɪnt/ is a semi-automatic OSINT framework and package manager. It's used by IT security professionals, bug bounty hunters, law enforcement agencies and in security awareness trainings to gather intelligence about a given target or about yourself. sn0int is enumerating...

domhttpx

domhttpx is a google search engine dorker with HTTP toolkit built with python, can make it easier for you to find many URLs/IPs at once with fast time. List Install Usage Flags Basic Usage One Keyword Multiple Keyword Extract Title Page Extract Title Page from Real Path Extract Status Code Extrac...

uddup

UDdup - URLs Deduplication Tool The tool gets a list of URLs, and removes "duplicate" pages in the sense of URL patterns that are probably repetitive and points to the same web template. For example: root@kitploit: https://www.example.com/product/123 https://www.example.com/product/456...

CSRF-breach

Progetto violazione di sicurezza - Cross Site Request Forgery Dolibarr 7.0.0 è affetto da: Cross Site Request Forgery CSRF. L'impatto è: permettere a HTML malintenzionato di cambiare la password dell'utente, disabilitare utenti e disabilitare la crittografia delle password. Il componente è:...

CVE-2018-7600-Masschecker

CVE-2018-7600-Masschecker Strumento per verificare la vulnerabilità CVE-2018-7600 su diversi URL...

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application affected in versions prior to 0.104.0 . The automatic image-download feature accepts file:// URLs in tags within text notes and performs a filesystem read with no path validation . Because the HTML sanitizer allows the file scheme, a...

CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81691

openssl_encrypt versions before 1.4.9 fail to validate server URLs in the login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. This allows an attacker on the network path to intercept cleartext credentials —including client_id, passwords, and JWTs—re...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

authkeysync

AuthKeySync Sincronizza automaticamente le chiavi pubbliche SSH da URL remote ai tuoi server 📖 Documentazione Completa Il Problema Gestire l'accesso SSH su più server è doloroso: I membri del team entrano o escono e devi aggiornare authorizedkeys su ogni server Gli sviluppatori ruotano le loro...

signy

signy Signierte URLs für kleine Geräte. Hintergrund signy ist eine Bibliothek zum Erstellen signierter URLs auf eingebetteten Geräten unter Verwendung asymmetrischer Kryptographie. Signierte URLs werden typischerweise verwendet, um zeitlich begrenzten Zugriff auf private Ressourcen zu gewähren, w...

xcrawl3r

xcrawl3r xcrawl3r is a command-line utility designed to recursively spider webpages for URLs. It works by actively traversing websites - following links embedded in webpages, and parsing files including sitemaps & robots.txt - to uncover every URL. Unlike xurlfind3r that doesn't interact directly...

TheTimeMachine

🚀 TheTimeMachine v3.0 - Armare Wayback per il Recon, Bug Bounty, OSINT e molto altro! Hai sentito parlare di viaggi nel tempo nei film e nei fumetti, vero? Beh, questa non è più finzione 😎. TheTimeMachine ti permette di scavare nel passato di qualsiasi app web estraendo URL archiviati dalla Wayba...

tirith

tirith आपका ब्राउज़र इसे पकड़ लेगा। आपका टर्मिनल नहीं पकड़ेगा। Website | Docs | SKILL.md | Changelog | Releases स्वतंत्र ओपन-सोर्स प्रोजेक्ट, जिसकी होस्टिंग Vercel Open Source Program Spring 2026 Cohort द्वारा समर्थित है। क्या आप अंतर देख सकते हैं? curl -sSL https://install.example-cli.dev | bash...