drift-corpus

Drift Corpus: Ring 0 Drift Corpus — это исчерпывающий репозиторий с открытым исходным кодом, содержащий diff-ы патчей ядра Windows. Эти артефакты создаются с помощью Drift Agent — автоматического движка обратной разработки ByteRay, являющегося частью платформы Argus-Systems. С помощью Drift мы...

threatspec

threatspec - непрерывное моделирование угроз через код Threatspec — это проект с открытым исходным кодом, направленный на сокращение разрыва между разработкой и безопасностью путем более глубокой интеграции процесса моделирования угроз в процесс разработки. Это достигается тем, что разработчики и...

CVE-2026-61911

A flaw was found in cyrus-imapd. An authenticated user could install a Sieve script to determine if another user's private mailbox exists. This is achieved by observing the behavior of the fileinto branch during Local Mail Transfer Protocol LMTP delivery. Additionally, this method could allow the...

CVE-2026-71807

RuoYi-Cloud-Plus versions up to 2.6.2 are affected in the ruoyi-workflow module. The root cause is that multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler or related user. Authenticated low-p...

EUVD-2026-57409

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents publish mode...

GHSA-V7PH-R5R6-4JCJ SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72808. Summary The /api/asset/getFileAnnotation endpoint returns the content of .sya PDF-annotation files with no publish-access check. It is gated by CheckAuth only, so it is reachable by the publish RoleReader token and by the anonymous account wh...

CVE-2026-77180

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

CVE-2026-77180

NGINX Ingress Controller is vulnerable to a configuration injection flaw (CWE-76) in its configuration generator. Multiple user-controllable Ingress annotation fields are written into the generated NGINX configuration without sanitization , allowing an authenticated attacker with Kubernetes API w...

EUVD-2026-70141

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

CVE-2026-77180 NGINX Ingress Controller vulnerability

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

PT-2026-84120

В свежем релизе cri-o исправили две уязвимости, одна из которых имеет критический уровень и может привести к побегу из контейнера. CVE-2026-62146 позволяет пользователю с правом создавать Pods отравить сохранённое состояние sandbox через произвольные annotations, а после рестарта CRI-O или...

CVE-2026-16440

A flaw was found in Eclipse OpenJ9. A remote attacker with low privileges could exploit this vulnerability by convincing a user to process a specially crafted .class file containing deeply nested annotations. This could lead to a segmentation fault, resulting in a Denial of Service DoS for the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: fixed data races related to remoteid. Similar to the previous patch, this issue was addressed by dealing with the data race on remoteid, by adding appropriate ONCE annotations...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: SCTP: A potential out-of-bounds exception has been prevented in sctptransportupdaterto. SYZBOOT reported a potential out-of-bounds exception 1. The responsible developer added rtoalphamax and set rtobetamax to 1000. It is...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2026-16440

Eclipse OpenJ9 versions up to 0.60 are vulnerable to a segmentation fault triggered by a crafted .class file containing deeply nested annotations. The root cause is improper handling of annotation nesting depth during class file processing, leading to a crash and denial of service . The CVSS 4.0 ...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

EUVD-2026-62368

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2026-66792

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...