OESA-2026-4039 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved:ALSA: caiaq: Use sndcardfreewhenclosed at disconnectionThe USB disconnect callback is supposed to be short and not too-longwaiting. OTOH, the current code uses...

OESA-2026-4038 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctpstreamupdate is only invoked when the association is moved into COOKIEWAIT during association...

OESA-2026-4032 rabbitmq-server security update

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fixes: RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP...

OESA-2026-4031 rabbitmq-server security update

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fixes: RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP...

OESA-2026-4030 rabbitmq-server security update

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fixes: RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP...

OESA-2026-4028 rabbitmq-server security update

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fixes: RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP...

CVE-2025-59287

In this study, we will examine a critical vulnerability CVE-2025-59287 discovered in the Microsoft Windows Server Update Services WSUS environment. This vulnerability arises from the unsafe deserialization of AuthorizationCookie objects sent to the GetCookie endpoint, where encrypted cookie data ...

XLL_Phishing

XLLPhishing Introduction With Microsoft's recent announcement regarding the blocking of macros in documents originating from the internet email AND web download, attackers have began aggressively exploring other options to achieve user driven access UDA. There are several considerations to be...

CVE-Factory

CVE-Factory: Scaling Expert-Level Agentic Tasks for Code Security Vulnerability CVE-Factory is a Multi-Agent system for fully automated, end-to-end CVE reproduction. Given CVE records, the system automatically researches details, generates test cases, builds Docker environments, and validates tha...

CVE-2026-6356

Augmentt: Privilege Escalation via Parameter Tampering Credits This CVE was a collaborative effort between: HelloWorld Author – GitHub: https://github.com/Penquinsecq Raznov – GitHub: https://github.com/basraznov Description A vulnerability in the web application allows standard users to escalate...

prowler

Prowler Prowler is a Network Vulnerability Scanner implemented on a Raspberry Pi Cluster, first developed during Singapore Infosec Community Hackathon - HackSmith v1.0. Capabilities Scan a network a particular subnet or a list of IP addresses for all IP addresses associated with active network...

CVE-2025-15260

CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. ...

sheepl

sheepl Sheepl : Creating realistic user behaviour for supporting tradecraft development within lab environments Introduction There are lots of resources available online relating to how you can build AD network environments for the development of blue team and red team tradecraft. However the...

CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint...

DEBIAN-CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint...

CNVD-2020-10487

Description The tool is intended for security research and internal audits only. It is forbidden to use it to launch illegal attacks. The user is responsible for any consequences. Apache Tomcat file inclusion vulnerability CVE-2020-1938 / CNVD-2020-1048 batch detection tool. This project is...

notepadpp-supply-chain-iocs

Notepad++ Supply Chain Attack — IoC Repository CVE-2025-15556 | Lotus Blossom / Raspberry Typhoon | June – December 2025 Overview This repository contains a comprehensive, consolidated collection of Indicators of Compromise IoCs related to the Notepad++ supply chain attack disclosed on February 2...

linkedin-profile-scraper

Due to endpoint issues, the Linkedin Profile Scraper Tool is currently unavailable. Please check the below link for alternative method. Huge shout-out to gosecure Team. https://www.gosecure.net/blog/2021/05/27/step-by-step-how-to-deanonymize-emails-on-linkedin/ Linkedin Profile scraper TOOL...

IMDSpoof

IMDSPOOF IMDSPOOF is a cyber deception tool that spoofs an AWS IMDS service. One way that attackers are able to escalate privileges or move laterally in a cloud environment is by retrieving AWS Access keys from the IMDS service endpoint located at...

ayaFlow

ayaFlow ayaFlow es un analizador de tráfico de red escrito en Rust + eBPF, construido con Aya. Ejecuta un agente por nodo Linux, adjunta un clasificador TC en ingreso y egreso, y expone datos de tráfico en vivo, historial respaldado por SQLite y métricas de Prometheus. Qué hace Captura tráfico...