chronix

Chronix Self-hosted collaborative workspace for pentesters and red team operators. Captures notes, commands, outputs, and operational context during security engagements. Quick Start Install pipx install git+https://github.com/IceCubeSandwich/chronix Initialize creates account and session secret...

Cartero

Cartero Cartero is now a Go CLI with an embedded, no-configuration workspace database instead of the old MongoDB-dependent runtime. The current implementation provides: a polished terminal experience powered by Cobra and Lip Gloss a local admin web UI and safe testing pages via cartero serve...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

CVE-2026-123284

In JetBrains Datalore versions prior to 2026.4 , an improper authorization vulnerability (CWE-863) exists during workspace moves. This flaw allows view-only collaborators to bypass intended permissions and modify shared content . The vulnerability has a CVSS 3.1 score of 6.5 (MEDIUM) , with poten...

CVE-2026-117621

A flaw was found in Jenkins. This vulnerability allows a Cross-Site Scripting XSS attack because the URLs displayed in the workspace browser for files and directories are computed directly on the build agent. An attacker who controls an agent process can exploit this flaw to inject and execute...

CVE-2026-119432

A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace file share preview functionality. An authenticated remote attacker can upload and share a maliciously crafted file; when a victim views or previews this file, the embedded script executes within the application's orig...

EUVD-2026-117888

A stored cross-site scripting XSS vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially...

CVE-2026-119431

A Server-Side Request Forgery (SSRF) vulnerability exists in the file-upload functionality of Foxit Workspace . The root cause is insufficient validation of user-supplied links , which could allow a remote attacker to force the server to access and return contents from internal resources. This co...

EUVD-2026-117887

A server-side request forgery SSRF vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-supplied links may allow a remote attacker to induce the server to access internal resources and return their contents, potentially resulting in sensitive...

EUVD-2026-117886

A server-side request forgery SSRF vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external...

CVE-2026-119433

A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace . The flaw stems from insufficient validation of network parameters and URLs supplied by users. A remote attacker could leverage this to force the server to make requests to arbitrary inte...

GDir-Thief

GDir-Thief Red Team tool for exfiltrating the target organization's Google People Directory that you have access to, via Google's People API. HOW TO Create a new Google Cloud Platform GCP project Steps to get the Google API Access Token needed for connecting to the API 1. Create a burner...

CVE-2026-123022

A flaw was found in AgentScope. A remote attacker can exploit this command injection vulnerability by submitting manipulated command parameters to the Model Context Protocol MCP Workspace API. Because input is passed directly to system execution functions without adequate validation, an attacker...

SlackPirate

SlackPirate - Slack Enumeration and Extraction Tool This is a tool developed in Python which uses the native Slack APIs to extract 'interesting' information from a Slack workspace given an access token. As of May 2018, Slack has over 8 million customers and that number is rapidly rising - the...

CVE-2026-119433: Foxit Software Inc. Foxit Workspace: A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to…

A server-side request forgery SSRF vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external...

CVE-2026-119432: Foxit Software Inc. Foxit Workspace: A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality

A stored cross-site scripting XSS vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially...

CVE-2026-119431: Foxit Software Inc. Foxit Workspace: A server-side request forgery (SSRF) vulnerability exists in Foxit Workspace's file-upload functionality

A server-side request forgery SSRF vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-supplied links may allow a remote attacker to induce the server to access internal resources and return their contents, potentially resulting in sensitive...

CVE-2026-123022

A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be...

EUVD-2026-117439

A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be...

CVE-2026-123022

The agentscope-ai AgentScope software (up to version 2.0.11 ) is vulnerable to an os command injection in the MCP Workspace API component. The root cause is the improper handling of the command argument within the subprocess.Popen function located in src/agentscope/mcp/_config.py. This vulnerabil...