Skip to content

Source index

Maintain this as the seed list of official or primary sources for the tool families documented here. Use these sources to discover offensive operator guidance for authorized testing, not blue-team alerting or defensive SecOps runbooks.

Application security research

  • Assemblyline service-client server-supplied digest traversal advisory and fix: https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865 and https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900
  • NanoClaw file-send, LettaBot management-route, Hermes memory-tool deny-policy, IronClaw/Mercury shell-approval, Mercury/CowAgent runtime tool-surface, LobsterAI artifact-file, JeecgBoot attachment-fetch, and super-agent-party file/fetch boundary records: https://github.com/advisories/GHSA-q94p-g4rh-r9rf, https://github.com/nanocoai/nanoclaw/issues/2760, https://github.com/advisories/GHSA-c8v3-2w4m-9q57, https://gist.github.com/YLChen-007/2ba2e586f3d16cb368c8dcd6ef680178, https://github.com/advisories/GHSA-6rr9-mpp7-j4mp, https://github.com/NousResearch/hermes-agent/issues/46171, https://github.com/NousResearch/hermes-agent/pull/46185, https://github.com/advisories/GHSA-cw23-qwr7-c655, https://github.com/nearai/ironclaw/issues/4861, https://github.com/nearai/ironclaw/pull/4869, https://github.com/advisories/GHSA-ccg4-hv3q-9622, https://github.com/cosmicstack-labs/mercury-agent/issues/72, https://github.com/advisories/GHSA-9hrj-55h5-5mr2, https://github.com/cosmicstack-labs/mercury-agent/issues/73, https://github.com/advisories/GHSA-7hmv-r6w5-pr73, https://github.com/cosmicstack-labs/mercury-agent/issues/74, https://github.com/advisories/GHSA-wjcq-xp37-c947, https://github.com/zhayujie/CowAgent/issues/2904, https://github.com/advisories/GHSA-7v78-v35x-cqg5, https://github.com/netease-youdao/LobsterAI/issues/2176, https://github.com/advisories/GHSA-wwv2-c3p6-cpr5, https://github.com/jeecgboot/JeecgBoot/issues/9672, https://github.com/advisories/GHSA-m39w-xf3h-v4h2, https://gist.github.com/YLChen-007/2f12ffb785d975b46b73896c0fb8cb5d, https://github.com/advisories/GHSA-fvhg-m33v-6wqx, and https://gist.github.com/YLChen-007/479bfabb441bd6cc5337db910b004841
  • Langflow August 5 validation, component-trust, knowledge-base, memory, and build-cache records: https://github.com/advisories/GHSA-994g-w9jv-hxcv, https://github.com/advisories/GHSA-x252-wm2h-6mf4, https://github.com/advisories/GHSA-wq52-m42w-xg45, https://github.com/advisories/GHSA-4q62-cj5w-qmfx, https://github.com/advisories/GHSA-7xr9-m7x2-5wqq, https://github.com/advisories/GHSA-vph6-jp7f-x3cx, and https://github.com/advisories/GHSA-f7wm-r5v3-mxr4
  • Gitea migration and OAuth fetch-policy advisory: https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc and https://github.com/advisories/GHSA-685p-fm6j-c445
  • ProjectDiscovery internal network scanning launch and agent workflow: https://projectdiscovery.io/blog/introducing-internal-network-scanning-see-your-network-the-way-an-attacker-inside-it-would
  • ProjectDiscovery rogue-agent benchmark trajectory case studies: https://projectdiscovery.io/blog/oh-my-rogue-agent
  • ProjectDiscovery offensive-agent behavioral audit and trajectory-integrity methodology: https://projectdiscovery.io/blog/watching-agents-work-a-behavioral-audit-of-offensive-security-llm-runs
  • TinyAGI message, prompt_file, and response-attachment records; NanoClaw child-agent creation; and openclaw-cn approval, sender, and symlink records: https://github.com/advisories/GHSA-w22m-c8rq-w42r, https://github.com/TinyAGI/tinyagi/issues/284, https://github.com/advisories/GHSA-2r4w-xxv7-6r74, https://github.com/TinyAGI/tinyagi/issues/283, https://github.com/advisories/GHSA-69rx-5vq2-c562, https://github.com/TinyAGI/tinyagi/issues/282, https://github.com/advisories/GHSA-grxx-9qr2-2q6v, https://github.com/nanocoai/nanoclaw/issues/2807, https://github.com/advisories/GHSA-p2px-f69r-9h28, https://github.com/mf-yang/openclaw-cn/issues/563, https://github.com/advisories/GHSA-f57q-9mhr-fhmm, https://github.com/mf-yang/openclaw-cn/issues/564, https://github.com/advisories/GHSA-2mj8-f2gc-5q5j, https://github.com/mf-yang/openclaw-cn/issues/565, and https://github.com/mf-yang/openclaw-cn/issues/566
  • Apache Polaris storage-location and WSO2 JWT/admin-token authority records: https://github.com/advisories/GHSA-62q9-5g2h-5gxp, https://lists.apache.org/thread/scd8p9wy8b9j3om5wohbotpfycnmmjl4, https://github.com/advisories/GHSA-j7vh-5w8q-4m4x, https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328, https://github.com/advisories/GHSA-88j3-cjwq-qqvv, and https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077
  • Keycloak SAML broker OneTimeUse replay record: https://github.com/advisories/GHSA-fghp-hcwh-75j2 and https://access.redhat.com/security/cve/CVE-2026-18967
  • PortSwigger HTTP Terminator desync-research campaign, protocol-ruler, deterministic evaluation, and discovery-cascade methodology: https://portswigger.net/research/http-terminator
  • Traefik CRD TCP cross-provider namespace and Gateway API ExtensionRef namespace-confusion advisories: https://github.com/advisories/GHSA-42cj-m3vj-89wv and https://github.com/advisories/GHSA-qq9q-x9w4-chhj
  • Nuxt server-island template/component and DevTools RPC advisories: https://github.com/advisories/GHSA-9473-5f9j-94wq, https://github.com/advisories/GHSA-48hr-524c-v5w3, and https://github.com/advisories/GHSA-279x-mwfv-vcqv
  • Dompdf advisories/source: https://github.com/dompdf/dompdf/security/advisories and https://github.com/dompdf/dompdf
  • Andromeda bytecode C2 research framework: https://github.com/vyrus001/andromeda
  • badkeys weak-key checker and web service: https://github.com/badkeys/badkeys and https://badkeys.info/
  • GitHub Security Advisories: https://github.com/advisories
  • Electron context-bridge, child-window feature-option, protocol/CORS, iframe permission/UI/sandbox navigation, DevTools, redirect-to-local-loader, session/cache, extension, path-parser, parent-signing, and off-screen rendering advisories: https://github.com/advisories/GHSA-h7rp-cf8h-j98x, https://github.com/advisories/GHSA-v93f-fgjr-hjrj, https://github.com/advisories/GHSA-v3j7-r9gq-3gjw, https://github.com/advisories/GHSA-9pf5-hg6p-4pwp, https://github.com/advisories/GHSA-x8rc-wpg4-grpf, https://github.com/advisories/GHSA-v64r-4m7r-3mvq, https://github.com/advisories/GHSA-r4w5-6pfg-jxp5, https://github.com/advisories/GHSA-m55f-7gqj-fr98, https://github.com/advisories/GHSA-5c9j-mhmv-5xgx, https://github.com/advisories/GHSA-jm7p-cc5g-qwxx, https://github.com/advisories/GHSA-pfmc-3mgc-p6fp, https://github.com/advisories/GHSA-9f4c-93c8-jc8g, https://github.com/advisories/GHSA-p2rr-rvmm-c5fp, https://github.com/advisories/GHSA-4f78-qhmw-8j8m, https://github.com/advisories/GHSA-f2r8-jv7c-xqmp, and https://github.com/advisories/GHSA-ff2p-hmqr-hxm4
  • Mojarra/DjangoCRM/MacCMS10 template and signing-key, wp-downloadmanager upload, toner-management route, XWiki/Invoice Ninja render, and openHAB proxy records: https://github.com/advisories/GHSA-wrxx-w58g-3gqp, https://github.com/advisories/GHSA-qwf5-72hq-pg7x, https://github.com/advisories/GHSA-qc6p-hvpv-4f8h, https://github.com/advisories/GHSA-cv48-22qx-mpmx, https://github.com/advisories/GHSA-cc9f-29gq-5x7c, https://github.com/advisories/GHSA-c6wq-2527-5fpx, https://github.com/advisories/GHSA-h2xq-h7f9-vh6c, https://github.com/advisories/GHSA-84j5-x242-f7h8, and https://github.com/advisories/GHSA-v7gr-mqpj-wwh3
  • Eclipse Theia filesystem/token/plugin/preference, Firefly III/Pixelfed/MLflow/Mealie outbound-fetch, Paperless-ngx credential-relay, Akaunting/Crater/Documize/Documenso object-scope, Magistrala/backmeup/xidown interpreter/process, Mautic identifier-SQL, Grocy render, and art-template loader records: https://github.com/advisories/GHSA-xrrm-6636-87r2, https://github.com/advisories/GHSA-34gw-v4cc-pv7c, https://github.com/advisories/GHSA-2mw2-h8hj-xpjg, https://github.com/advisories/GHSA-5f8h-2xph-wwxv, https://github.com/advisories/GHSA-q8pq-98hq-mg7f, https://github.com/advisories/GHSA-5cfc-gvxj-5r55, https://github.com/advisories/GHSA-h7x2-h6g9-p789, https://github.com/advisories/GHSA-q2c2-jwjg-8cxx, https://github.com/advisories/GHSA-666w-8983-6664, https://github.com/advisories/GHSA-h26w-wq3x-9p76, https://github.com/advisories/GHSA-2467-45mc-2xp5, https://github.com/advisories/GHSA-4gcg-395p-mg6g, https://github.com/advisories/GHSA-v65x-57rf-cpg3, https://github.com/advisories/GHSA-vq5v-m87m-6pqm, https://github.com/advisories/GHSA-c6xg-rfqh-85cp, https://github.com/advisories/GHSA-f3j9-9qqv-p4r8, https://github.com/advisories/GHSA-rq57-g9hr-4f9r, https://github.com/advisories/GHSA-c924-wcfj-cr8j, and https://github.com/advisories/GHSA-mj55-6q5h-prw4
  • CPython archive relocation, Windows drive-path, and hardlink-filter advisories: https://github.com/advisories/GHSA-9mc4-rqmq-h467, https://github.com/advisories/GHSA-7r27-jhmm-vmp6, and https://github.com/advisories/GHSA-gf2w-jqmq-fcm8
  • LINE Android profile-template code-injection advisory: https://line.github.io/security-advisory-blog/CVE-2026-16881 and https://github.com/advisories/GHSA-86g4-8jpx-6pgq
  • Zyxel ZLD firewall configuration-file traversal advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-the-configuration-file-execution-cli-command-of-zld-firewalls-08-04-2026 and https://github.com/advisories/GHSA-75p7-jv3w-pjpc
  • ASUSTOR Backup Plan/EZSync privileged IPC advisory: https://www.asustor.com/security/security_advisory_detail?id=70 and https://github.com/advisories/GHSA-2p27-7hcf-mpp3
  • GeoVision Lighttpd static firmware-key records: https://github.com/advisories/GHSA-7p93-2qwj-4g34 and https://github.com/advisories/GHSA-qfjw-8qqh-5c6x
  • WordPress Dropbox, upload, log-token, subscription, template, RSVP, and alternate-dispatch boundary records: https://github.com/advisories/GHSA-g948-x7cf-x6p5, https://github.com/advisories/GHSA-62v2-7mcm-qpm4, https://github.com/advisories/GHSA-5v73-chf6-5qjj, https://github.com/advisories/GHSA-8hc5-48cx-v7wp, https://github.com/advisories/GHSA-w3xr-4xq6-f7jx, https://github.com/advisories/GHSA-32f3-4hg9-xrh4, and https://github.com/advisories/GHSA-rxcc-hfjf-j3mp
  • Flowise SQLite, prediction-context, mapped-address, CSV Agent, NodeVM, cross-type delete, MCP environment-policy, OAuth/credential, history, S3 loader, runtime-variable, Unicode-validator, subscription, TTS, and execution-update follow-up advisories: https://github.com/advisories/GHSA-x3hf-7cj6-3r4m, https://github.com/advisories/GHSA-6vh2-wg4h-4vwj, https://github.com/advisories/GHSA-c6xh-wv4j-ppv5, https://github.com/advisories/GHSA-x6vm-w76m-8j7g, https://github.com/advisories/GHSA-vmv7-4m6c-3cg5, https://github.com/advisories/GHSA-3769-jgqc-cxm7, https://github.com/advisories/GHSA-p5w8-m249-4r4v, https://github.com/advisories/GHSA-xc48-889x-5qmw, https://github.com/advisories/GHSA-wch5-xp77-fxg4, https://github.com/advisories/GHSA-rwrp-9823-p2xq, https://github.com/advisories/GHSA-fr6g-7cq8-fg82, https://github.com/advisories/GHSA-chm3-vqcf-52rx, https://github.com/advisories/GHSA-4j8x-x6v7-w9rq, https://github.com/advisories/GHSA-88pr-878c-24wf, https://github.com/advisories/GHSA-8r8h-6vcc-xhrv, https://github.com/advisories/GHSA-52fh-8v99-63c2, https://github.com/advisories/GHSA-qgvm-j2hm-6m38, https://github.com/advisories/GHSA-5xvg-pmgg-3mxr, https://github.com/advisories/GHSA-gmmw-qg98-6j6p, https://github.com/advisories/GHSA-8gj2-2cvc-6xx7, and https://github.com/advisories/GHSA-fm2f-4339-4p2f
  • Open WebUI August 4 OAuth-client, terminal-preview, NAT64, Playwright-subresource, Vega, image-feature, channel-authorship, DNS-rebinding, direct-model knowledge, cleanup-parent, shared-folder, KaTeX fallback, tool-source, and WebSocket-role advisories: https://github.com/advisories/GHSA-rq84-p6rr-vf89, https://github.com/advisories/GHSA-3xpf-xq7r-v8c5, https://github.com/advisories/GHSA-8x5v-cpv7-8jjp, https://github.com/advisories/GHSA-w2rx-84hp-gg95, https://github.com/advisories/GHSA-rffm-9q57-q649, https://github.com/advisories/GHSA-g423-grf7-98rv, https://github.com/advisories/GHSA-mj5r-jf49-m3w7, https://github.com/advisories/GHSA-h6x2-583h-x99r, https://github.com/advisories/GHSA-6xhv-rxhv-pwm4, https://github.com/advisories/GHSA-jxc9-xmc4-gr23, https://github.com/advisories/GHSA-3cg5-48j3-v4gv, https://github.com/advisories/GHSA-pwxh-7358-jq2x, https://github.com/advisories/GHSA-3r7g-q6cg-q2vx, and https://github.com/advisories/GHSA-5gpj-vj23-vhhv
  • Ghost August 4 mapped-address fetch, object-storage upload type, Universal Import, offer-state, public-filter, caption-render, and feature-fetch advisories: https://github.com/advisories/GHSA-wvp2-4qqp-4h3r, https://github.com/advisories/GHSA-944x-pm95-3jpr, https://github.com/advisories/GHSA-2gx6-7gx2-wwcf, https://github.com/advisories/GHSA-4wx2-7gvj-qfq3, https://github.com/advisories/GHSA-jx35-x7fj-vgpr, https://github.com/advisories/GHSA-pr22-p9rp-2cqv, and https://github.com/advisories/GHSA-x5mm-wm4g-j5xv
  • Bedrock AgentCore crafted-content tool invocation, A2UI browser action, and OpenMeter stored-query records: https://aws.amazon.com/security/security-bulletins/2026-073-aws, https://nvd.nist.gov/vuln/detail/CVE-2026-18830, https://nvd.nist.gov/vuln/detail/CVE-2026-10032, and https://nvd.nist.gov/vuln/detail/CVE-2026-18801
  • marimo, Perspective, Eclipse Milo, and stunnel August 4 trust-boundary advisories: https://github.com/advisories/GHSA-v9v8-jp27-55gf, https://github.com/advisories/GHSA-pcjm-g28j-xmf9, https://github.com/advisories/GHSA-3jqr-28gj-8vq4, https://github.com/advisories/GHSA-jrjq-9cmf-3h6f, https://github.com/advisories/GHSA-xg6h-qgc7-qqr7, https://github.com/advisories/GHSA-978q-37g3-wq8g, https://github.com/advisories/GHSA-pvvm-cxq7-hrgr, and https://github.com/advisories/GHSA-2x69-8qrg-27gr
  • Google MCP Toolbox, yggdrasil-worker-package-manager, and Node.js permission-model boundary advisories: https://github.com/advisories/GHSA-656w-qf75-c5gf, https://github.com/advisories/GHSA-f8h2-c55w-8m5p, https://github.com/advisories/GHSA-24pp-m59v-92j8, https://github.com/advisories/GHSA-3x3x-8ffg-ghcv, https://github.com/advisories/GHSA-f9rr-qg3x-wq4m, and https://github.com/advisories/GHSA-4qw5-6jhx-9hfx
  • Keycloak July 31 identity-policy advisories: https://github.com/advisories/GHSA-6j79-4gfx-fm6f, https://github.com/advisories/GHSA-jg59-c35g-76r8, https://github.com/advisories/GHSA-v8h5-7wp9-qxxv, https://github.com/advisories/GHSA-wx5m-whr8-48h5, https://github.com/advisories/GHSA-vhxw-j6h3-48jm, https://github.com/advisories/GHSA-2w88-g477-cxmj, https://github.com/advisories/GHSA-82v3-6227-jc8x, https://github.com/advisories/GHSA-w32v-46r7-99r7, https://github.com/advisories/GHSA-c8xx-fr3x-6m5w, and https://github.com/advisories/GHSA-wmhp-w67v-6jm5
  • WordPress July 31 auth-proof, workflow, backup, and deserialization advisories: https://github.com/advisories/GHSA-2982-9p75-vfp8, https://github.com/advisories/GHSA-cfr3-ggcx-jjf3, https://github.com/advisories/GHSA-j2wf-m8xp-xm7q, https://github.com/advisories/GHSA-g4w8-444w-x9q8, https://github.com/advisories/GHSA-24j9-5c5r-9c88, https://github.com/advisories/GHSA-q89r-49r9-5hmx, and https://github.com/advisories/GHSA-rpvq-6gf9-58vg
  • Zeppelin, Kyuubi, 389 Directory Server, and RHACS July 31 boundary advisories: https://github.com/advisories/GHSA-5j5v-r5qf-p5c4, https://github.com/advisories/GHSA-pp6r-c7gq-g5pr, https://github.com/advisories/GHSA-r7mx-568f-jgg3, and https://github.com/advisories/GHSA-vq3f-pc8h-pv73
  • WordPress MailerPress/MailPress and Fluent Forms July 31 REST/object-proof advisories: https://github.com/advisories/GHSA-gjcp-gv56-hccw, https://github.com/advisories/GHSA-vfgx-g9m5-wfgv, and https://github.com/advisories/GHSA-gx6f-fm4p-x72r
  • WordPress WooCommerce Social Login, User Access Manager, and CubeWP August 2 identity/file-boundary advisories and source: https://github.com/advisories/GHSA-qwc9-q2f8-q72q, https://github.com/advisories/GHSA-mxw9-rxrv-85f3, https://plugins.svn.wordpress.org/user-access-manager/tags/2.3.14/, https://github.com/advisories/GHSA-2cff-wc4f-2m48, and https://plugins.svn.wordpress.org/cubewp-framework/tags/1.1.30/
  • Logging operator advisories/source: https://github.com/kube-logging/logging-operator/security/advisories and https://github.com/kube-logging/logging-operator
  • Active Record Tenanted advisories/source: https://github.com/basecamp/activerecord-tenanted/security/advisories and https://github.com/basecamp/activerecord-tenanted
  • proot-distro advisories/source: https://github.com/termux/proot-distro/security/advisories and https://github.com/termux/proot-distro
  • Easy!Appointments advisories/source: https://github.com/alextselegidis/easyappointments/security/advisories and https://github.com/alextselegidis/easyappointments
  • Spring LDAP, Framework WebSocket, and HATEOAS advisories/source: https://spring.io/security/, https://github.com/spring-projects/spring-ldap, https://github.com/spring-projects/spring-framework, and https://github.com/spring-projects/spring-hateoas
  • Google ADK confirmation, app-builder ZIP extraction, NASA AIT-GUI, Cisco Secure FMC, and Reactor Netty redirect control-boundary sources: https://github.com/google/adk-python/commit/c03f333769feaeaa9fe8910fbe95cb9f2d513f54, https://github.com/develar/app-builder/pull/163, https://www.kb.cert.org/vuls/id/293714, https://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh, and https://spring.io/security/cve-2026-41715/
  • GitLab CI/import/AI authorization, Consul MCP session/authority, pip package-index path, V URL-parser, and Heimdall generated-config sources: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/, https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612, https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/, https://github.com/vlang/v/issues/27945, and https://www.zerodayinitiative.com/advisories/ZDI-26-447/
  • ZITADEL advisories/source: https://github.com/zitadel/zitadel/security/advisories and https://github.com/zitadel/zitadel
  • swagger-typescript-api advisories/source: https://github.com/acacode/swagger-typescript-api/security/advisories and https://github.com/acacode/swagger-typescript-api
  • veraPDF validation advisories/source: https://github.com/veraPDF/veraPDF-validation/security/advisories and https://github.com/veraPDF/veraPDF-validation
  • Quarkus HTTP path-policy advisory/source: https://github.com/advisories/GHSA-qcxp-gm7m-4j5v and https://github.com/quarkusio/quarkus
  • Prebid Server outbound-request advisory/source: https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx and https://github.com/prebid/prebid-server
  • Elixir Req multipart advisory/source: https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m and https://github.com/wojtekmach/req
  • AWS AgentCore CLI import-codegen advisory/source: https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7 and https://github.com/aws/agentcore-cli
  • Dynatrace MCP approval advisory/source: https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-pc2w-4mq8-32qw and https://github.com/dynatrace-oss/dynatrace-mcp
  • Penelope and decompress archive advisories/source: https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r, https://github.com/brightio/penelope, and https://github.com/advisories/GHSA-h39j-r5qq-r9mm
  • GNU Bison grammar-control research and fixes: https://cert.pl/en/posts/2026/07/CVE-2026-56389/, https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=3169c1e7a2c6acc4c59dfcf8b089896d6881925b, and https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=8d101c19d4d9aaedf83a448c925513742d4efcf0
  • Apache Kyuubi Engine UI proxy advisory/source: https://github.com/advisories/GHSA-qvj4-xxw2-22gf and https://github.com/apache/kyuubi/pull/7483
  • Apache Airflow FAB Azure AD token-verification advisory/source: https://github.com/advisories/GHSA-q5r3-w69r-hrfw and https://github.com/apache/airflow/pull/69374
  • Apache Atlas admin-authorization advisory: https://github.com/advisories/GHSA-w667-wgvw-q2hc
  • Pocket ID advisories/source: https://github.com/pocket-id/pocket-id/security/advisories and https://github.com/pocket-id/pocket-id
  • Novu advisories/source: https://github.com/novuhq/novu/security/advisories and https://github.com/novuhq/novu
  • WordPress Coding Standards advisories/source: https://github.com/WordPress/WordPress-Coding-Standards/security/advisories and https://github.com/WordPress/WordPress-Coding-Standards
  • Wakaru advisories/source: https://github.com/pionxzh/wakaru/security/advisories and https://github.com/pionxzh/wakaru
  • lettre advisories/source: https://github.com/lettre/lettre/security/advisories and https://github.com/lettre/lettre
  • Appium Java client advisories/source: https://github.com/appium/java-client/security/advisories and https://github.com/appium/java-client
  • nono registry-pack advisories/source: https://github.com/always-further/nono/security/advisories and https://github.com/nolabs-ai/nono
  • Pterodactyl Panel and Wings advisories/source: https://github.com/pterodactyl/panel/security/advisories, https://github.com/pterodactyl/panel, and https://github.com/pterodactyl/wings
  • pytonapi webhook advisories/source: https://github.com/nessshon/tonapi/security/advisories and https://github.com/nessshon/tonapi
  • Ruby OAuth and OAuth2 advisories/source: https://github.com/ruby-oauth/oauth/security/advisories, https://github.com/ruby-oauth/oauth2/security/advisories, https://github.com/ruby-oauth/oauth, and https://github.com/ruby-oauth/oauth2
  • GNOME librest PKCE issue/source: https://gitlab.gnome.org/GNOME/librest/-/issues/25 and https://gitlab.gnome.org/GNOME/librest
  • Poweradmin identity URL advisory/source: https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3735-5339-xfwx and https://github.com/poweradmin/poweradmin
  • zip-lib extraction advisories/source: https://github.com/advisories?query=zip-lib and https://github.com/fpsqdb/zip-lib
  • Prompty advisories/source: https://github.com/microsoft/prompty/security/advisories and https://github.com/microsoft/prompty
  • mcp-memory-keeper advisories/source: https://github.com/mkreyman/mcp-memory-keeper/security/advisories and https://github.com/mkreyman/mcp-memory-keeper
  • Flask-Reuploaded advisories/source: https://github.com/advisories?query=Flask-Reuploaded and https://github.com/jugmac00/flask-reuploaded
  • uutils coreutils advisories/source: https://github.com/uutils/coreutils/security/advisories and https://github.com/uutils/coreutils
  • Trail of Bits Patch the Planet field reports: https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/
  • Trail of Bits goal-driven bug-hunting and variant-analysis workflow: https://blog.trailofbits.com/2026/07/28/how-we-use-goal-to-find-bugs-in-patch-the-planet/
  • Trail of Bits Mewt mutation-testing DAML support: https://blog.trailofbits.com/2026/07/08/mutation-testing-comes-to-daml/ and https://github.com/trailofbits/mewt
  • Trail of Bits Rust Testing Handbook update and rust-review plugin: https://blog.trailofbits.com/2026/07/13/rust-proof-your-code-with-our-new-testing-handbook-chapter/ and https://github.com/trailofbits/skills/tree/main/plugins/rust-review
  • Fission advisories/source: https://github.com/fission/fission/security/advisories and https://github.com/fission/fission
  • Cedar Express authorization middleware advisories/source: https://github.com/cedar-policy/authorization-for-expressjs/security/advisories and https://github.com/cedar-policy/authorization-for-expressjs
  • KubeVirt advisories/source: https://github.com/kubevirt/kubevirt/security/advisories and https://github.com/kubevirt/kubevirt
  • Apache Shiro advisories: https://shiro.apache.org/security-reports.html
  • Apache Syncope advisories: https://syncope.apache.org/security
  • Sigstore Java advisories/source: https://github.com/sigstore/sigstore-java/security/advisories and https://github.com/sigstore/sigstore-java
  • Model Context Protocol Java SDK advisories/source: https://github.com/modelcontextprotocol/java-sdk/security/advisories and https://github.com/modelcontextprotocol/java-sdk
  • Ray advisories/source: https://github.com/ray-project/ray/security/advisories and https://github.com/ray-project/ray
  • MetaGPT source/issues: https://github.com/FoundationAgents/MetaGPT and https://github.com/FoundationAgents/MetaGPT/issues
  • go-fastdfs-web advisories/research references: https://github.com/advisories/GHSA-6g49-gvr8-2cj2 and https://vuldb.com/vuln/369017
  • vertex-app Vertex source/fixes: https://github.com/vertex-app/vertex and https://github.com/vertex-app/vertex/commit/805d82e7100d49b79b3beb1b9420e8e458987198
  • clash-verge-service-ipc source/releases: https://github.com/clash-verge-rev/clash-verge-service-ipc and https://github.com/clash-verge-rev/clash-verge-service-ipc/releases/tag/v2.3.0
  • NLTK advisories/source: https://github.com/nltk/nltk/security/advisories and https://github.com/nltk/nltk
  • NiceGUI advisories/source: https://github.com/zauberzeug/nicegui/security/advisories and https://github.com/zauberzeug/nicegui
  • Picklescan advisories/source: https://github.com/mmaitre314/picklescan/security/advisories and https://github.com/mmaitre314/picklescan
  • rclone advisories/source, including translated-link, serve restic, metadata, and RC error-boundary records: https://github.com/rclone/rclone/security/advisories, https://github.com/advisories/GHSA-cf44-9pgv-m4xc, https://github.com/advisories/GHSA-45pq-889g-fcgh, https://github.com/advisories/GHSA-945v-v9p3-v5xw, https://github.com/advisories/GHSA-gwfq-86j8-7qhv, and https://github.com/rclone/rclone
  • Hugging Face Transformers advisories/source: https://github.com/huggingface/transformers/security/advisories and https://github.com/huggingface/transformers
  • ONNX source/issues: https://github.com/onnx/onnx and https://github.com/onnx/onnx/issues
  • Budibase advisories/source: https://github.com/Budibase/budibase/security/advisories and https://github.com/Budibase/budibase
  • Yii 2 advisories/source: https://github.com/yiisoft/yii2/security/advisories and https://github.com/yiisoft/yii2
  • OpenClaw advisories/source: https://github.com/openclaw/openclaw/security/advisories and https://github.com/openclaw/openclaw
  • openclaw-cn browser navigation policy issues/source: https://github.com/mf-yang/openclaw-cn/issues/561, https://github.com/mf-yang/openclaw-cn/issues/562, and https://github.com/mf-yang/openclaw-cn
  • SparkJava external static-file symlink issue/source: https://github.com/perwendel/spark/issues/1296 and https://github.com/perwendel/spark
  • Hermes SimpleX display-name authorization issues/source: https://github.com/NousResearch/hermes-agent/issues/44729, https://github.com/NousResearch/hermes-agent/issues/44730, and https://github.com/NousResearch/hermes-agent
  • Hermes todo snapshot/context-compression prompt-authority issue and fix: https://github.com/advisories/GHSA-xq8w-9jvx-gm3v, https://github.com/NousResearch/hermes-agent/issues/26979, and https://github.com/NousResearch/hermes-agent/pull/69860
  • NanoClaw approval callback and MCP payload issues/source: https://github.com/nanocoai/nanoclaw/issues/2761, https://github.com/nanocoai/nanoclaw/issues/2762, and https://github.com/nanocoai/nanoclaw
  • SiYuan Publish-to-MCP authorization advisory/source: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cvhv-7xhj-xjp8 and https://github.com/siyuan-note/siyuan
  • OpenRemote console-registration authorization advisory/source: https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv and https://github.com/openremote/openremote
  • datamodel-code-generator customBasePath code-generation validation/source: https://github.com/advisories/GHSA-7x49-hhjc-29rg and https://github.com/koxudaxi/datamodel-code-generator/commit/545a96c5
  • free5GC advisories/source: https://github.com/free5gc/free5gc/security/advisories and https://github.com/free5gc/free5gc
  • OpenStack Ironic advisories/source: https://security.openstack.org/ and https://opendev.org/openstack/ironic
  • BentoML advisories/source: https://github.com/bentoml/BentoML/security/advisories and https://github.com/bentoml/BentoML
  • Weblate advisories/source: https://github.com/WeblateOrg/weblate/security/advisories and https://github.com/WeblateOrg/weblate
  • vLLM advisories/source: https://github.com/vllm-project/vllm/security/advisories and https://github.com/vllm-project/vllm
  • Strawberry GraphQL advisories/source: https://github.com/strawberry-graphql/strawberry/security/advisories and https://github.com/strawberry-graphql/strawberry
  • lxml advisories/source: https://github.com/lxml/lxml/security/advisories and https://github.com/lxml/lxml
  • Waku advisories/source: https://github.com/wakujs/waku/security/advisories and https://github.com/wakujs/waku
  • Skipper advisories/source: https://github.com/zalando/skipper/security/advisories and https://github.com/zalando/skipper
  • CloudTAK advisories/source: https://github.com/dfpc-coe/CloudTAK/security/advisories and https://github.com/dfpc-coe/CloudTAK
  • AngleSharp advisories/source: https://github.com/AngleSharp/AngleSharp/security/advisories and https://github.com/AngleSharp/AngleSharp
  • LangChain advisories/source: https://github.com/langchain-ai/langchain/security/advisories and https://github.com/langchain-ai/langchain
  • LangGraph advisories/source: https://github.com/langchain-ai/langgraph/security/advisories and https://github.com/langchain-ai/langgraph
  • go-chi/chi advisories/source: https://github.com/go-chi/chi/security/advisories and https://github.com/go-chi/chi
  • Lemur advisories/source: https://github.com/Netflix/lemur/security/advisories and https://github.com/Netflix/lemur
  • Amazon Braket SDK advisories/source: https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories and https://github.com/amazon-braket/amazon-braket-sdk-python
  • Cisco Unified Communications advisories: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW
  • PTC security advisories: https://www.ptc.com/en/support/article/CS473270
  • MindsDB advisories/source: https://github.com/mindsdb/mindsdb/security/advisories and https://github.com/mindsdb/mindsdb
  • MindsDB file upload path traversal advisory: https://github.com/advisories/GHSA-4894-xqv6-vrfq
  • MONAI advisories/source: https://github.com/Project-MONAI/MONAI/security/advisories and https://github.com/Project-MONAI/MONAI
  • CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (JSON: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
  • JetBrains TeamCity agent-polling deserialization records: https://www.jetbrains.com/privacy-security/issues-fixed/, https://nvd.nist.gov/vuln/detail/CVE-2026-63077, https://github.com/advisories/GHSA-94gx-v738-fx9w, and https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  • Check Point SmartConsole application-token authentication bypass and Trusted Client documentation: https://support.checkpoint.com/results/sk/sk185169 and https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Defining-Trusted-Clients.htm
  • Shopper advisories/source: https://github.com/shopperlabs/shopper/security/advisories and https://github.com/shopperlabs/shopper
  • TinyMCE advisories/source: https://github.com/tinymce/tinymce/security/advisories and https://github.com/tinymce/tinymce
  • NASA AMMOS AIT-Core advisories/source: https://github.com/NASA-AMMOS/AIT-Core/security/advisories and https://github.com/NASA-AMMOS/AIT-Core
  • Gradio advisories/source: https://github.com/gradio-app/gradio/security/advisories and https://github.com/gradio-app/gradio
  • Hugging Face Diffusers advisories/source: https://github.com/huggingface/diffusers/security/advisories and https://github.com/huggingface/diffusers
  • Trail of Bits Fickling advisories/source: https://github.com/trailofbits/fickling/security/advisories and https://github.com/trailofbits/fickling
  • free5GC NRF source/advisories: https://github.com/free5gc/nrf and https://github.com/free5gc/free5gc/issues
  • JupyterHub LTI Authenticator advisories/source: https://github.com/jupyterhub/ltiauthenticator/security/advisories and https://github.com/jupyterhub/ltiauthenticator
  • NocoDB advisories and source: https://github.com/nocodb/nocodb/security/advisories and https://github.com/nocodb/nocodb
  • DbGate advisories/source: https://github.com/dbgate/dbgate/security/advisories and https://github.com/dbgate/dbgate
  • Sync-in Server advisories/source: https://github.com/Sync-in/server/security/advisories and https://github.com/Sync-in/server
  • Flux source-controller advisories/source: https://github.com/fluxcd/source-controller/security/advisories and https://github.com/fluxcd/source-controller
  • MCP Server Kubernetes advisories and source: https://github.com/Flux159/mcp-server-kubernetes/security/advisories and https://github.com/Flux159/mcp-server-kubernetes
  • Omni advisories and source: https://github.com/siderolabs/omni/security/advisories and https://github.com/siderolabs/omni
  • Authlib advisories and source: https://github.com/lepture/authlib/security/advisories and https://github.com/lepture/authlib
  • Wasmtime advisories and source: https://github.com/bytecodealliance/wasmtime/security/advisories and https://github.com/bytecodealliance/wasmtime
  • Crawl4AI advisories and source: https://github.com/unclecode/crawl4ai/security/advisories and https://github.com/unclecode/crawl4ai
  • changedetection.io advisories and source: https://github.com/dgtlmoon/changedetection.io/security/advisories and https://github.com/dgtlmoon/changedetection.io
  • Dagster advisories and source: https://github.com/dagster-io/dagster/security/advisories and https://github.com/dagster-io/dagster
  • Django security releases and advisories: https://docs.djangoproject.com/en/dev/releases/security/ and https://github.com/django/django/security/advisories
  • AgentScope advisories and source: https://github.com/modelscope/agentscope/security/advisories and https://github.com/modelscope/agentscope
  • Netavark / Podman networking advisories and fixes: https://github.com/containers/netavark, https://github.com/containers/netavark/security/advisories, https://github.com/containers/podman/issues
  • APScheduler advisories: https://github.com/agronholm/apscheduler/security/advisories
  • BillaBear advisories/project: https://github.com/billabear/billabear and https://github.com/advisories/GHSA-xp6r-8pcc-xv5p
  • MCP-for-Stata advisories: https://github.com/SepineTam/stata-mcp/security/advisories
  • Shopware advisories: https://github.com/shopware/shopware/security/advisories
  • AdGuard Home advisories: https://github.com/AdguardTeam/AdGuardHome/security/advisories
  • dnsproxy source/fixes: https://github.com/AdguardTeam/dnsproxy
  • Nuclio advisories: https://github.com/nuclio/nuclio/security/advisories
  • Better Auth advisories: https://github.com/better-auth/better-auth/security/advisories
  • Doorkeeper OpenID Connect advisories: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/security/advisories
  • WebOb advisories: https://github.com/Pylons/webob/security/advisories
  • Axios advisories: https://github.com/axios/axios/security/advisories
  • Envoy Gateway advisories/source: https://github.com/envoyproxy/gateway/security/advisories and https://github.com/envoyproxy/gateway
  • Kuma advisories/source: https://github.com/kumahq/kuma/security/advisories and https://github.com/kumahq/kuma
  • MCP Python SDK advisories/source: https://github.com/modelcontextprotocol/python-sdk/security/advisories and https://github.com/modelcontextprotocol/python-sdk
  • Mirasvit Cache Warmer changelog: https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer
  • Sansec Mirasvit Cache Warmer object-injection research: https://sansec.io/research/mirasvit-cache-warmer-object-injection
  • ruby-jwt advisories: https://github.com/jwt/ruby-jwt/security/advisories
  • Starlette advisories: https://github.com/Kludex/starlette/security/advisories
  • Linux kernel source and fixes: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
  • Apache ActiveMQ security advisories: https://activemq.apache.org/security-advisories
  • Oracle Critical Patch Updates: https://www.oracle.com/security-alerts/
  • Mattermost advisories: https://github.com/mattermost/mattermost/security/advisories
  • kas advisories: https://github.com/siemens/kas/security/advisories
  • rattler advisories: https://github.com/conda/rattler/security/advisories
  • Vitest advisories: https://github.com/vitest-dev/vitest/security/advisories
  • DOMPurify advisories: https://github.com/cure53/DOMPurify/security/advisories
  • Sentry Python SDK advisories: https://github.com/getsentry/sentry-python/security/advisories
  • Git LFS advisories: https://github.com/git-lfs/git-lfs/security/advisories
  • phpMyFAQ advisories: https://github.com/thorsten/phpMyFAQ/security/advisories
  • arnika advisories: https://github.com/arnika-project/arnika/security/advisories
  • PraisonAI advisories: https://github.com/MervinPraison/PraisonAI/security/advisories
  • Formie advisories: https://github.com/verbb/formie/security/advisories
  • authentik advisories: https://github.com/goauthentik/authentik/security/advisories
  • CC-Tweaked advisories: https://github.com/cc-tweaked/CC-Tweaked/security/advisories
  • Keras advisories: https://github.com/keras-team/keras/security/advisories
  • Admidio advisories: https://github.com/Admidio/admidio/security/advisories
  • OpenC3 COSMOS advisories: https://github.com/OpenC3/cosmos/security/advisories
  • YARD advisories: https://github.com/lsegal/yard/security/advisories
  • Ouroboros advisories: https://github.com/Q00/ouroboros/security/advisories
  • Stigmem advisories: https://github.com/eidetic-labs/stigmem/security/advisories
  • Koel advisories: https://github.com/koel/koel/security/advisories
  • LangBot advisories/source: https://github.com/RockChinQ/LangBot/security/advisories and https://github.com/RockChinQ/LangBot
  • Summarize advisories: https://github.com/steipete/summarize/security/advisories and https://www.vulncheck.com/advisories/
  • Amazon Redshift Python driver advisories: https://github.com/aws/amazon-redshift-python-driver/security/advisories
  • uv advisories: https://github.com/astral-sh/uv/security/advisories
  • russh advisories: https://github.com/Eugeny/russh/security/advisories
  • AgenticMail advisories: https://github.com/agenticmail/agenticmail/security/advisories
  • tar-rs advisories: https://github.com/composefs/tar-rs/security/advisories
  • Parse Server advisories: https://github.com/parse-community/parse-server/security/advisories
  • Palo Alto Networks PAN-OS advisories: https://security.paloaltonetworks.com/
  • vm2 advisories: https://github.com/patriksimek/vm2/security/advisories
  • Go-Guerrilla SMTP daemon advisories/source: https://github.com/flashmob/go-guerrilla/security/advisories and https://github.com/flashmob/go-guerrilla
  • Puma advisories/source: https://github.com/puma/puma/security/advisories and https://github.com/puma/puma
  • Arc advisories/source: https://github.com/basekick-labs/arc/security/advisories and https://github.com/basekick-labs/arc
  • 1Panel advisories/source: https://github.com/1Panel-dev/1Panel/security/advisories and https://github.com/1Panel-dev/1Panel
  • SGLang advisories: https://github.com/sgl-project/sglang/security/advisories
  • SGLang inference control-boundary advisories: https://github.com/advisories/GHSA-96j3-rjf9-2hxp, https://github.com/advisories/GHSA-vwmc-327h-6x3j, https://github.com/advisories/GHSA-r344-357p-w9pp, https://github.com/advisories/GHSA-x6x2-r266-cx9p, https://github.com/advisories/GHSA-359v-m36h-r94v, and https://github.com/advisories/GHSA-hg26-hr8r-fxc9
  • MeshCentral, SFTPGo, RapidRAW, and Red Hat Leapp controller/file-boundary advisories: https://github.com/advisories/GHSA-fcvp-v754-r7rh, https://github.com/advisories/GHSA-3964-29ff-vwff, https://github.com/advisories/GHSA-2jwx-hj3p-pj84, and https://github.com/advisories/GHSA-9hgq-3p3x-rvvw
  • OpenClaw transcript-to-dashboard rendering advisory: https://github.com/advisories/GHSA-hc44-65x2-rvc2
  • Apache Tika ISA-Tab and Leantime blueprint file-reference advisories: https://github.com/advisories/GHSA-vrmh-37mg-28h3 and https://github.com/advisories/GHSA-rfxf-9pcf-q3rq
  • Outstatic, Wolf CMS, Spikster, Juggle, and MikroTik control-plane advisories: https://github.com/advisories/GHSA-59rr-38mm-f3g9, https://github.com/advisories/GHSA-xv6g-v6rg-vw4p, https://github.com/advisories/GHSA-3pqf-wrr6-rf9m, https://github.com/advisories/GHSA-rg37-h5w6-fj69, https://github.com/advisories/GHSA-8rhq-39vx-cjqx, and https://github.com/advisories/GHSA-x9w7-jgwj-cp2f
  • ChromaDB advisories and research: https://github.com/chroma-core/chroma/security/advisories and https://www.hiddenlayer.com/research/chromatoast-served-pre-auth
  • ngrok npm wrapper advisory reference: https://gist.github.com/Dremig/90c2a0a2f85b0921f10e0bb3192a0c23
  • astral-tokio-tar advisories: https://github.com/astral-sh/tokio-tar/security/advisories
  • eZ Publish Legacy security advisories/labs: https://github.com/ezsystems/ezpublish-legacy/security/advisories and https://github.com/Goaterino/ezpublish-legacy-lab
  • Cluster API Provider Metal3 advisories: https://github.com/metal3-io/cluster-api-provider-metal3/security/advisories
  • python-tuf advisories: https://github.com/theupdateframework/python-tuf/security/advisories
  • Dulwich advisories: https://github.com/dulwich/dulwich/security/advisories
  • nono advisories: https://github.com/always-further/nono/security/advisories
  • local-deep-research advisories: https://github.com/LearningCircuit/local-deep-research/security/advisories
  • shamefile advisories: https://github.com/BKDDFS/shamefile/security/advisories
  • Symfony polyfill advisories: https://github.com/symfony/polyfill/security/advisories
  • mem0 advisories: https://github.com/mem0ai/mem0/security/advisories
  • compliance-trestle advisories: https://github.com/oscal-compass/compliance-trestle/security/advisories
  • Flask-HTTPAuth advisories: https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories
  • league/commonmark advisories: https://github.com/thephpleague/commonmark/security/advisories
  • mamba / mamba-ssm advisories: https://github.com/state-spaces/mamba/security/advisories
  • Guardrails AI advisories: https://github.com/guardrails-ai/guardrails/security/advisories
  • Horovod project advisories: https://github.com/horovod/horovod/security/advisories
  • AsyncSSH advisories: https://github.com/ronf/asyncssh/security/advisories
  • Automad advisories: https://github.com/marcantondahmen/automad/security/advisories
  • Hapi content advisories: https://github.com/hapijs/content/security/advisories
  • Hapi wreck advisories: https://github.com/hapijs/wreck/security/advisories
  • Hapi inert advisories/source: https://github.com/hapijs/inert/security/advisories and https://github.com/hapijs/inert
  • Pimcore advisories: https://github.com/pimcore/pimcore/security/advisories
  • Symfony routing advisories: https://github.com/symfony/symfony/security/advisories
  • Symfony security-http advisories: https://github.com/symfony/symfony/security/advisories
  • Symfony HtmlSanitizer advisories: https://github.com/symfony/symfony/security/advisories
  • Capsule / Project Capsule advisories: https://github.com/projectcapsule/capsule/security/advisories
  • Symfony MonologBridge advisories: https://github.com/symfony/symfony/security/advisories
  • Symfony Cache advisories: https://github.com/symfony/symfony/security/advisories
  • Symfony Mailer advisories: https://github.com/symfony/symfony/security/advisories
  • Symfony Mime advisories: https://github.com/symfony/symfony/security/advisories
  • Symfony DomCrawler advisories: https://github.com/symfony/symfony/security/advisories
  • CrowdSec advisories: https://github.com/crowdsecurity/crowdsec/security/advisories
  • Deno advisories: https://github.com/denoland/deno/security/advisories
  • Langroid advisories: https://github.com/langroid/langroid/security/advisories
  • tmp / node-tmp advisories: https://github.com/raszi/node-tmp/security/advisories
  • Nezha Monitoring advisories: https://github.com/nezhahq/nezha/security/advisories
  • Arcane advisories: https://github.com/getarcaneapp/arcane/security/advisories
  • AstrBot advisories: https://github.com/AstrBotDevs/AstrBot/security/advisories
  • Beetl project issues/advisories: https://gitee.com/xiandafu/beetl/issues
  • instagrapi advisories: https://github.com/subzeroid/instagrapi/security/advisories
  • aiograpi advisories: https://github.com/subzeroid/aiograpi/security/advisories
  • Flask-Security advisories: https://github.com/pallets-eco/flask-security/security/advisories
  • FileBrowser Quantum advisories: https://github.com/gtsteffaniak/filebrowser/security/advisories
  • Drupal core security advisories: https://www.drupal.org/security
  • Prefect security advisories: https://github.com/PrefectHQ/prefect/security/advisories
  • Apache Camel security advisories: https://camel.apache.org/security/
  • Apache Airflow security advisories: https://github.com/apache/airflow/security/advisories
  • Fission security advisories: https://github.com/fission/fission/security/advisories
  • Kolibri advisories/source: https://github.com/learningequality/kolibri/security/advisories and https://github.com/learningequality/kolibri
  • Keycloak advisories/source: https://github.com/keycloak/keycloak/security/advisories and https://github.com/keycloak/keycloak
  • Boxlite security advisories: https://github.com/rapiz1/boxlite/security/advisories
  • containerd security advisories: https://github.com/containerd/containerd/security/advisories
  • Pydantic AI security advisories: https://github.com/pydantic/pydantic-ai/security/advisories
  • SQLAdmin security advisories: https://github.com/aminalaee/sqladmin/security/advisories
  • Twig security advisories: https://github.com/twigphp/Twig/security/advisories
  • Bugsink security advisories: https://github.com/bugsink/bugsink/security/advisories
  • Tekton Pipelines security advisories: https://github.com/tektoncd/pipeline/security/advisories
  • Apache Flink security advisories: https://flink.apache.org/what-is-flink/security/
  • YesWiki security advisories: https://github.com/YesWiki/yeswiki/security/advisories
  • Network-AI security advisories: https://github.com/Jovancoding/Network-AI/security/advisories
  • JavaScript Cookie security advisories: https://github.com/js-cookie/js-cookie/security/advisories
  • pyload-ng security advisories: https://github.com/pyload/pyload/security/advisories
  • Crawlee security advisories: https://github.com/apify/crawlee-python/security/advisories
  • Crabbox security advisories: https://github.com/openclaw/crabbox/security/advisories
  • Langflow security advisories: https://github.com/langflow-ai/langflow/security/advisories
  • samlify advisories: https://github.com/tngan/samlify/security/advisories
  • Windows-MCP advisories: https://github.com/CursorTouch/Windows-MCP/security/advisories
  • OpenMetadata advisories: https://github.com/open-metadata/OpenMetadata/security/advisories
  • sanitize-html advisories: https://github.com/apostrophecms/sanitize-html/security/advisories
  • SvelteKit advisories: https://github.com/sveltejs/kit/security/advisories
  • md-fileserver advisories: https://github.com/commenthol/md-fileserver/security/advisories
  • Amazon SageMaker Python SDK advisories: https://github.com/aws/sagemaker-python-sdk/security/advisories
  • LMDeploy advisories: https://github.com/InternLM/lmdeploy/security/advisories
  • Anyquery advisories/source: https://github.com/julien040/anyquery/security/advisories and https://github.com/julien040/anyquery
  • pip security advisories: https://github.com/pypa/pip/security/advisories
  • OpenClaude advisories: https://github.com/Gitlawb/openclaude/security/advisories
  • TeleJSON advisories: https://github.com/storybookjs/telejson/security/advisories
  • Apify MCP server advisories: https://github.com/apify/actors-mcp-server/security/advisories
  • protobufjs advisories: https://github.com/protobufjs/protobuf.js/security/advisories
  • Open WebUI advisories: https://github.com/open-webui/open-webui/security/advisories
  • OpenClaw advisories: https://github.com/openclaw/openclaw/security/advisories
  • HashiCorp Nomad advisories: https://github.com/hashicorp/nomad/security/advisories
  • go-git advisories: https://github.com/go-git/go-git/security/advisories
  • zrok advisories: https://github.com/openziti/zrok/security/advisories
  • Mailpit advisories: https://github.com/axllent/mailpit/security/advisories
  • Argo CD advisories: https://github.com/argoproj/argo-cd/security/advisories
  • Nuxt advisories: https://github.com/nuxt/nuxt/security/advisories
  • Gotenberg advisories: https://github.com/gotenberg/gotenberg/security/advisories
  • HAXcms / HAX advisories: https://github.com/haxtheweb/issues/security/advisories
  • Algernon advisories: https://github.com/xyproto/algernon/security/advisories
  • Scriban advisories: https://github.com/scriban/scriban/security/advisories
  • Nginx-UI advisories/source: https://github.com/0xJacky/nginx-ui/security/advisories and https://github.com/0xJacky/nginx-ui
  • OpenSearch JavaScript client advisories: https://github.com/opensearch-project/opensearch-js/security/advisories
  • Python idna advisories: https://github.com/kjd/idna/security/advisories
  • ApostropheCMS advisories: https://github.com/apostrophecms/apostrophe/security/advisories
  • Weblate advisories: https://github.com/WeblateOrg/weblate/security/advisories
  • Typebot advisories: https://github.com/baptisteArno/typebot.io/security/advisories
  • XWiki advisories: https://github.com/xwiki/xwiki-commons/security/advisories
  • CryptPad advisories: https://github.com/cryptpad/cryptpad/security/advisories
  • XWiki Platform advisories: https://github.com/xwiki/xwiki-platform/security/advisories
  • Yeoman environment advisories: https://github.com/yeoman/environment/security/advisories
  • Fedify advisories: https://github.com/fedify-dev/fedify/security/advisories
  • Yamcs advisories: https://github.com/yamcs/yamcs/security/advisories
  • FUXA advisories: https://github.com/frangoteam/FUXA/security/advisories
  • Kirby CMS advisories: https://github.com/getkirby/kirby/security/advisories
  • Kata Containers advisories: https://github.com/kata-containers/kata-containers/security/advisories
  • CarrierWave advisories: https://github.com/carrierwaveuploader/carrierwave/security/advisories
  • LiquidJS advisories: https://github.com/harttle/liquidjs/security/advisories
  • LiteSpeed cPanel plugin security updates: https://blog.litespeedtech.com/
  • Apache Tomcat security advisories: https://tomcat.apache.org/security.html
  • ImageMagick security policy and releases: https://imagemagick.org/script/security-policy.php
  • NiceGUI advisories: https://github.com/zauberzeug/nicegui/security/advisories
  • HAPI FHIR project: https://github.com/hapifhir/hapi-fhir
  • PyTorch Lightning project: https://github.com/Lightning-AI/pytorch-lightning
  • Snorkel project: https://github.com/snorkel-team/snorkel
  • PySyft project: https://github.com/OpenMined/PySyft
  • .NET security advisories: https://github.com/dotnet/announcements/issues
  • ASP.NET Core security advisories: https://github.com/dotnet/aspnetcore/security/advisories
  • ws WebSocket advisories: https://github.com/websockets/ws/security/advisories
  • AVideo advisories: https://github.com/WWBN/AVideo/security/advisories
  • pgAdmin security advisories: https://www.pgadmin.org/support/security/
  • Faraday project security advisories: https://github.com/lostisland/faraday/security/advisories
  • Docling project and advisories: https://github.com/docling-project/docling and https://github.com/docling-project/docling/security/advisories
  • Jupyter Enterprise Gateway advisories: https://github.com/jupyter-server/enterprise_gateway/security/advisories
  • browserstack-runner advisories: https://github.com/browserstack/browserstack-runner/security/advisories
  • AIOHTTP advisories: https://github.com/aio-libs/aiohttp/security/advisories
  • ModelScope advisories/project: https://github.com/modelscope/modelscope/security/advisories and https://github.com/modelscope/modelscope
  • Neotoma project: https://github.com/NeotomaDB/neotoma
  • Trail of Bits Blog: https://blog.trailofbits.com/ (RSS: https://blog.trailofbits.com/feed/)
  • Trail of Bits skill-distribution scanner-bypass research: https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/
  • PortSwigger Research: https://portswigger.net/research (RSS: https://portswigger.net/research/rss)
  • Hacktron AI Blog: https://www.hacktron.ai/blog/
  • ProjectDiscovery Blog: https://projectdiscovery.io/blog/
  • Brutecat Security articles: https://brutecat.com/articles/ (RSS: https://brutecat.com/rss.xml)
  • pretix advisories and releases: https://github.com/pretix/pretix/security/advisories and https://pretix.eu/about/en/blog/
  • Easy Digital Downloads import-upload advisory/source: https://github.com/advisories/GHSA-fcpv-9325-98hg and https://plugins.svn.wordpress.org/easy-digital-downloads/
  • Advanced Responsive Video Embedder compromised-release advisory/source: https://github.com/advisories/GHSA-45wh-rxq4-jqc6 and https://plugins.svn.wordpress.org/advanced-responsive-video-embedder/tags/10.8.7/
  • Eazy Plugin Manager and StoreGrowth source: https://plugins.svn.wordpress.org/plugins-on-steroids/ and https://plugins.svn.wordpress.org/storegrowth-sales-booster/
  • SICK PSIRT CSAF advisories: https://www.sick.com/.well-known/csaf/provider-metadata.json and https://www.sick.com/psirt
  • ProjectDiscovery Neo: https://neo.projectdiscovery.io/
  • ProjectDiscovery Neo black-box DAST benchmark notes: https://projectdiscovery.io/blog/neo-black-box-dast-capabilities
  • Argus validation benchmarks: https://github.com/pensarai/argus-validation-benchmarks
  • XBOW validation benchmarks: https://github.com/xbow-engineering/validation-benchmarks
  • Caddy security advisories: https://github.com/caddyserver/caddy/security/advisories
  • Spring AI MCP Security: https://github.com/spring-ai-community/mcp-security
  • webpack-dev-server advisories: https://github.com/webpack/webpack-dev-server/security/advisories
  • eduMFA advisories: https://github.com/eduMFA/eduMFA/security/advisories
  • Statamic CMS security advisories: https://github.com/statamic/cms/security/advisories
  • MLflow security advisories: https://github.com/mlflow/mlflow/security/advisories
  • Magick.NET/ImageMagick advisories: https://github.com/dlemstra/Magick.NET/security/advisories
  • flash-attention project: https://github.com/Dao-AILab/flash-attention
  • Zebra security advisories: https://github.com/ZcashFoundation/zebra/security/advisories
  • dynoxide project/advisories: https://github.com/wojciech-graj/dynoxide/security/advisories
  • Dozzle project/advisories: https://github.com/amir20/dozzle/security/advisories
  • Erlang cowlib advisories: https://github.com/ninenines/cowlib/security/advisories
  • LibreNMS advisories: https://github.com/librenms/librenms/security/advisories
  • CI4MS advisories: https://github.com/ci4-cms-erp/ci4ms/security/advisories
  • OpenTelemetry eBPF Instrumentation advisories: https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories
  • Mistral AI package advisories: https://github.com/mistralai/client-python/security/advisories
  • Spring AI advisories: https://github.com/spring-projects/spring-ai/security/advisories
  • Docker/Moby security advisories: https://github.com/moby/moby/security/advisories
  • Budibase advisories: https://github.com/Budibase/budibase/security/advisories
  • n8n-MCP advisories: https://github.com/czlonkowski/n8n-mcp/security/advisories
  • multiparty advisories: https://github.com/pillarjs/multiparty/security/advisories
  • Coder advisories: https://github.com/coder/coder/security/advisories
  • 9router advisories/source: https://github.com/advisories?query=9router and https://github.com/9router/9router
  • Kong Ingress Controller advisories: https://github.com/Kong/kubernetes-ingress-controller/security/advisories
  • Bandit advisories: https://github.com/mtrudel/bandit/security/advisories
  • Cowboy advisories: https://github.com/ninenines/cowboy/security/advisories
  • MCP Gateway advisories: https://github.com/IBM/mcp-context-forge/security/advisories
  • MCP Atlassian advisories/source: https://github.com/sooperset/mcp-atlassian/security/advisories and https://github.com/sooperset/mcp-atlassian
  • SQLFluff advisories: https://github.com/sqlfluff/sqlfluff/security/advisories
  • libp2p JavaScript advisories: https://github.com/libp2p/js-libp2p/security/advisories
  • Kopia advisories: https://github.com/kopia/kopia/security/advisories
  • Angular security advisories: https://github.com/angular/angular/security/advisories
  • Caddy Defender advisories: https://github.com/JasonLovesDoggo/caddy-defender/security/advisories
  • Nautobot security advisories: https://github.com/nautobot/nautobot/security/advisories
  • Gradio advisories: https://github.com/gradio-app/gradio/security/advisories
  • Anchor framework advisories: https://github.com/coral-xyz/anchor/security/advisories
  • Keycloak security advisories: https://github.com/keycloak/keycloak/security/advisories
  • Eclipse Jetty security advisories: https://github.com/jetty/jetty.project/security/advisories
  • Axios advisories: https://github.com/axios/axios/security/advisories
  • Froxlor advisories: https://github.com/froxlor/Froxlor/security/advisories
  • GitHub CLI advisories: https://github.com/cli/cli/security/advisories
  • seroval advisories: https://github.com/lxsmnsyc/seroval/security/advisories
  • Databento DBN advisories: https://github.com/databento/dbn/security/advisories
  • Rclone advisories: https://github.com/rclone/rclone/security/advisories
  • Mako advisories: https://github.com/sqlalchemy/mako/security/advisories
  • Faraday advisories: https://github.com/lostisland/faraday/security/advisories
  • pm2 advisories: https://github.com/Unitech/pm2/security/advisories
  • Palo Alto Networks security advisories: https://security.paloaltonetworks.com/
  • phpMyFAQ advisories: https://github.com/thorsten/phpMyFAQ/security/advisories
  • NocoDB advisories: https://github.com/nocodb/nocodb/security/advisories
  • MCP Server Kubernetes advisories: https://github.com/Flux159/mcp-server-kubernetes/security/advisories
  • FlaskBB advisories: https://github.com/flaskbb/flaskbb/security/advisories
  • Knp Snappy advisories: https://github.com/KnpLabs/snappy/security/advisories
  • Flowise advisories: https://github.com/FlowiseAI/Flowise/security/advisories
  • wger advisories: https://github.com/wger-project/wger/security/advisories
  • setup-php advisories: https://github.com/shivammathur/setup-php/security/advisories
  • Hugging Face Diffusers advisories: https://github.com/huggingface/diffusers/security/advisories
  • OpenTofu advisories: https://github.com/opentofu/opentofu/security/advisories
  • Plug advisories: https://github.com/elixir-plug/plug/security/advisories
  • Craft CMS security advisories: https://github.com/craftcms/cms/security/advisories
  • MCP Registry advisories: https://github.com/modelcontextprotocol/registry/security/advisories
  • Hono advisories: https://github.com/honojs/hono/security/advisories
  • Nhost advisories: https://github.com/nhost/nhost/security/advisories
  • Singularity advisories: https://github.com/sylabs/singularity/security/advisories
  • AVideo advisories: https://github.com/WWBN/AVideo/security/advisories
  • OpenMeter advisories: https://github.com/openmeterio/openmeter/security/advisories
  • Spree advisories: https://github.com/spree/spree/security/advisories
  • Gogs advisories/source: https://github.com/gogs/gogs/security/advisories and https://github.com/gogs/gogs
  • OpenCTI advisories/source: https://github.com/OpenCTI-Platform/opencti/security/advisories and https://github.com/OpenCTI-Platform/opencti
  • motionEye advisories/source: https://github.com/motioneye-project/motioneye/security/advisories and https://github.com/motioneye-project/motioneye
  • Paymenter advisories/source: https://github.com/Paymenter/Paymenter/security/advisories and https://github.com/Paymenter/Paymenter
  • n8n advisories/source: https://github.com/n8n-io/n8n/security/advisories and https://github.com/n8n-io/n8n
  • Sigstore Fulcio advisories/source: https://github.com/sigstore/fulcio/security/advisories and https://github.com/sigstore/fulcio
  • CefSharp advisories/source: https://github.com/cefsharp/CefSharp/security/advisories and https://github.com/cefsharp/CefSharp
  • AdonisJS bodyparser advisories/source: https://github.com/adonisjs/bodyparser/security/advisories and https://github.com/adonisjs/bodyparser
  • Oban Web advisories/source: https://github.com/oban-bg/oban/security/advisories and https://github.com/oban-bg/oban
  • Probo advisories/source: https://github.com/probo/probo/security/advisories and https://github.com/probo/probo
  • ORAS Go advisories/source: https://github.com/oras-project/oras-go/security/advisories and https://github.com/oras-project/oras-go
  • Ghost security advisories/source: https://github.com/TryGhost/Ghost/security/advisories and https://github.com/TryGhost/Ghost
  • goshs advisories/source: https://github.com/patrickhener/goshs/security/advisories and https://github.com/patrickhener/goshs
  • Apache Ignite advisories/source: https://ignite.apache.org/security.html and https://github.com/apache/ignite
  • OnGres SCRAM project: https://github.com/ongres/scram
  • oasdiff advisories/source: https://github.com/oasdiff/oasdiff/security/advisories and https://github.com/oasdiff/oasdiff
  • KEDA advisories/source: https://github.com/kedacore/keda/security/advisories and https://github.com/kedacore/keda
  • Goploy advisories/source: https://github.com/zhenorzz/goploy/security/advisories and https://github.com/zhenorzz/goploy
  • ha-mcp advisories/source: https://github.com/homeassistant-ai/ha-mcp/security/advisories and https://github.com/homeassistant-ai/ha-mcp
  • aiosmtplib advisories/source: https://github.com/cole/aiosmtplib/security/advisories and https://github.com/cole/aiosmtplib
  • Kite advisories/source: https://github.com/zxh326/kite/security/advisories and https://github.com/zxh326/kite
  • Apache Fesod advisories/source: https://github.com/apache/fesod/security/advisories and https://github.com/apache/fesod
  • Kimai advisories/source: https://github.com/kimai/kimai/security/advisories and https://github.com/kimai/kimai
  • Gitea advisories/source: https://github.com/go-gitea/gitea/security/advisories and https://github.com/go-gitea/gitea
  • GitPython advisories/source: https://github.com/gitpython-developers/GitPython/security/advisories and https://github.com/gitpython-developers/GitPython
  • SVGO advisories/source: https://github.com/svg/svgo/security/advisories and https://github.com/svg/svgo
  • Jackson Databind advisories/source: https://github.com/FasterXML/jackson-databind/security/advisories and https://github.com/FasterXML/jackson-databind
  • SharpCompress advisories/source: https://github.com/adamhathcock/sharpcompress/security/advisories and https://github.com/adamhathcock/sharpcompress
  • FrontMCP advisories/source: https://github.com/frontmcp/frontmcp/security/advisories and https://github.com/frontmcp/frontmcp
  • etcd advisories/source: https://github.com/etcd-io/etcd/security/advisories and https://github.com/etcd-io/etcd
  • Oh My Posh advisories/source: https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories and https://github.com/JanDeDobbeleer/oh-my-posh
  • OpenList advisories/source: https://github.com/OpenListTeam/OpenList/security/advisories and https://github.com/OpenListTeam/OpenList
  • http4s blaze advisories/source: https://github.com/http4s/blaze/security/advisories and https://github.com/http4s/blaze
  • OmniFaces advisories/source: https://github.com/omnifaces/omnifaces/security/advisories and https://github.com/omnifaces/omnifaces
  • Shescape advisories/source: https://github.com/ericcornelissen/shescape/security/advisories and https://github.com/ericcornelissen/shescape
  • AWS API MCP Server advisories/source: https://github.com/awslabs/mcp/security/advisories and https://github.com/awslabs/mcp
  • Apache Traffic Server security announcements and source: https://trafficserver.apache.org/security/ and https://github.com/apache/trafficserver
  • Koollab LMS advisory cluster: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094

Network and service discovery

  • Nmap reference: https://nmap.org/book/man.html
  • Nmap NSE reference: https://nmap.org/nsedoc/
  • ProjectDiscovery httpx: https://github.com/projectdiscovery/httpx

DNS and subdomain enumeration

  • OWASP Amass: https://github.com/owasp-amass/amass
  • Subfinder: https://github.com/projectdiscovery/subfinder
  • PureDNS: https://github.com/d3mondev/puredns
  • MassDNS: https://github.com/blechschmidt/massdns
  • Gobuster: https://github.com/OJ/gobuster

Maintenance rules

  • Prefer official documentation, source repos, vendor advisories, and primary project docs.
  • Only convert advisory/news items into wiki content when they produce an offensive testing skill, replayable validation workflow, recon heuristic, or exploit-path lesson for authorized work.
  • Add a source here when a new skill depends on it repeatedly.
  • Remove links that stop being canonical.