A structured overview of the BloodHound attack-path analysis ecosystem — official ingestors, community collectors, converters, ADWS alternatives, analysis tools, deployment helpers, and supporting frameworks.
Legend
- 🟢 Official — maintained by SpecterOps
- 🔵 Community — third-party / unofficial
SHA-256: 54077a5b15638e354fa02318623775b7a1cc0e8c21e59bcbab333035369e377f
Analysis Date: 2026-04-08
Related Research: EXPMON Blog - Zero-Day Adobe Reader Exploit
VirusTotal: VT Report
The code snippets and conceptual analysis presented in this document are based on iOS 16.2.
The bug was disclosed and patched after Pwn2Own 2024 and was assigned CVE-2024-27834. Details of the patch can be found in the WebKit repository.
| rule RTF_with_potential_CVE_2026_21509_exploit | |
| { | |
| meta: | |
| description = "Detects RTF files containing a Shell.Explorer.1 OLE object, possibly an exploit for CVE-2026-21509" | |
| author = "Philippe Lagadec" | |
| reference = "https://decalage.info/CVE-2026-21509/" | |
| version = "1.2" | |
| date = "2026-02-03" | |
| license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE" | |
| // samples: https://bazaar.abuse.ch/browse/tag/CVE-2026-21509/ |
| # script to scan MS Office files, looking for "Shell.Explorer" OLE objects which could match CVE-2026-21509 | |
| # using oletools - https://github.com/decalage2/oletools | |
| # Philippe Lagadec 2026-01-28 | |
| # NOTES: | |
| # According to the MS advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 | |
| # the CVE-2026-21509 vulnerability is related to CLSID "EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B", | |
| # corresponding to the "Shell.Explorer" COM object, which can be used to open the legacy | |
| # Internet Explorer engine (aka Trident/MSHTML) from any application. | |
| # So to exploit CVE2026-21509 from a MS Office document, one could use either an OLE object |
| IF NOT EXISTS ( | |
| select | |
| 1 | |
| from | |
| vSMS_SC_ClientComponent_PropertyLists | |
| where | |
| ID = 72057594037927956 | |
| and Name = N 'Network Access User Names' | |
| ) insert into vSMS_SC_ClientComponent_PropertyLists (ID, Value, Name) | |
| values |
hi, i'm daniel. i'm a 16-year-old high school senior. in my free time, i hack billion dollar companies and build cool stuff.
about a month ago, a couple of friends and I found serious critical vulnerabilities on Mintlify, an AI documentation platform used by some of the top companies in the world.
i found a critical cross-site scripting vulnerability that, if abused, would let an attacker to inject malicious scripts into the documentation of numerous companies and steal credentials from users with a single link open.
(go read my friends' writeups (after this one))
how to hack discord, vercel, and more with one easy trick (eva)
Redacted by Counsel: A supply chain postmortem (MDL)
| POST / HTTP/1.1 | |
| Host: localhost | |
| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 | |
| Next-Action: x | |
| Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad | |
| Content-Length: 459 | |
| ------WebKitFormBoundaryx8jO2oVc6SWP3Sad | |
| Content-Disposition: form-data; name="0" |
| id: geoserver-wms-sld-xxe | |
| info: | |
| name: GeoServer WMS SLD XXE Detection | |
| author: bolhasec | |
| severity: medium | |
| description: | | |
| Attempts to exploit an XXE vulnerability via a StyledLayerDescriptor (SLD) | |
| in a WMS GetMap POST request. A secure GeoServer instance should reject | |
| entity resolution and return an error like "Entity resolution disallowed for file". |
Fortinet assigned FG-IR-25-910 / CVE-2025-64446 to this issue on 14 Nov 2025, rating it Critical (CVSS 9.1) and confirming exploitation in the wild. The official advisory describes it as a “path confusion” (relative path traversal) in the FortiWeb GUI that lets an unauthenticated attacker execute administrative commands via crafted HTTP(S) requests. The mechanics match our findings: a traversal under /api/v2.0/… reaches /migadmin/cgi-bin/fwbcgi, and cgi_auth() blindly trusts the attacker-supplied HTTP_CGIINFO header to impersonate any administrator.
httpd.conf registers <Location /api/v2.0/> SetHandler fwbcgi-handler. Apache matches the prefix before decoding %3f or collapsing /../, so /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi is forwarded straight to fwbcgi.cgi_auth() trusts client-supplie