The vulnerability of Visual Studio Code’s source editor, related to the occurrence of interpretation conflicts, allows attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to the occurrence of interpretation conflicts. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

PT-2026-107265

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.54.6 Description Scaffolder source-control actions may not consistently enforce intended credential boundaries. This allows an authenticated user to cause an affected action to fall back to broader integration...

The vulnerability of Visual Studio Code’s source editor lies in its insufficient checking of unusual or exceptional states, allowing attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

PT-2026-107300

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.3.1 Backstage versions prior to 3.4.1 Backstage versions prior to 4.0.3 Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains an authorization bypass regarding...

PT-2026-106783

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions prior to 4.0.0-canary.34 Description An access-control bypass exists in the duplicate operation, which allows the copying of values from a source document even if a field is hidden or if t...

Karma Pro 0.14

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

Rocket.Chat

La solución segura y de código abierto definitiva para las comunicaciones de equipo Rocket.Chat es una plataforma de comunicaciones segura, completamente personalizable y de código abierto, desarrollada en TypeScript para organizaciones con altos estándares de protección de datos. Somos la soluci...

grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...

grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...

security-baseline-ubuntu

☕ Support the Project If this practical guide has saved your host from compromise, helped you configure your security baseline, or saved you hours of debugging AppArmor and Firejail profiles, you can support the author and further development of this open-source initiative. ⚠️ OPSEC Warning:...

CVE-2026-43499-T807D

T807D Producto final — Paquete de recuperación de correspondencia uno a uno con el código fuente Fecha de generación: 2026-08-08 Conclusión Este directorio ya ha organizado el árbol de código fuente completo de popsicle que se puede recuperar del proyecto actual, los encabezados necesarios, la...

CVE-2026-93326 Crafted Git build source can bypass certain policy validation

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, fo...

opencode

El agente de programación con IA de código abierto. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Instalación YOLO curl -fsSL...

Grafana-CVE-2021-43798

Grafana-CVE-2021-43798 Implementación en Python de una herramienta para descifrar y cifrar datos sensibles en Grafana, abordando específicamente las vulnerabilidades asociadas con CVE-2021-43798. Grafana cifra todas las contraseñas de las fuentes de datos utilizando el algoritmo AES con la...

CVE-2026-93317

A flaw was found in BuildKit. An unauthenticated remote attacker controlling a container registry or Open Container Initiative OCI blob source can provide data that does not match its claimed cryptographic digest. Because BuildKit caches the resulting snapshot under the claimed digest, subsequent...

Open-Source-Threat-Intel-Feeds

Fuentes Gratuitas de Threat Intel/IOC Este repositorio contiene fuentes de Threat Intel de código abierto y de uso gratuito que pueden utilizarse sin requisitos adicionales. El CSV ThreatIntelFeeds está almacenado de forma estructurada según el Proveedor, la Descripción, la Categoría y la URL. Lo...

CyberQRM

CyberQRM – Gestión Cuantitativa de Riesgos Cibernéticos Una plataforma local de código abierto para la evaluación cuantitativa de riesgos de ciberseguridad utilizando el marco FAIR v3.1 Factor Analysis of Information Risk. Modele amenazas, ejecute simulaciones Monte Carlo, mida la efectividad de...

bidi-guard

bidi-guard Escanea código en busca de caracteres Unicode bidireccionales invisibles Por Qué Existe Esto Los caracteres Unicode bidireccionales invisibles pueden hacer que el código fuente se muestre de forma distinta a como se ejecuta. Esto es CVE-2021-42574 — el ataque Trojan Source. Un atacante...

EUVD-2026-92529

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

xalgorix

Xalgorix — Pentester de IA de código abierto que demuestra vulnerabilidades La mayoría de los escáneres detectan. Xalgorix demuestra. Un agente LLM autónomo aplica una metodología completa de pentesting, y luego un verificador independiente reexplotа cada hallazgo antes de que se reporte — así...