lazywarden

Sistema de Copia de Seguridad e Importación Seguro, Automatizado y Multi-Nube para Bitwarden Lazywarden es una herramienta de automatización en Python diseñada para hacer copias de seguridad y restaurar datos de tu bóveda, incluidos los archivos adjuntos de Bitwarden. Te permite subir las copias ...

sklad

Sklad 📦 Sklad es un gestor de snippets multiplataforma que vive en la bandeja del sistema. Almacena contraseñas, claves de API, fragmentos de código y cualquier texto que copies con frecuencia, todo cifrado y siempre a un clic de distancia. Sklad Demo ✨ Características 🔒 Protección por contraseña...

CrabCrypt

Si encuentras útil este repositorio de GitHub, ¡por favor considera darle una estrella! ⭐️ CrabCrypt🦀🔐 CrabCrypt es una herramienta de cifrado de archivos segura con interfaz gráfica, diseñada para cifrar y descifrar cualquier archivo sin esfuerzo. Con cifrado AES y una elegante interfaz Tkinter,...

VSHG

VSHG - Resistencia de hardware y seguridad mejorada para GnuPG. VSHG tiene como objetivo proporcionar un refuerzo resistente a memoria/hardware para la función de derivación de clave s2k estándar de GnuPG + una interfaz simplificada para el cifrado simétrico . Acerca de VSHG VSHG Generador de has...

Security Bulletin: Bouncy Castle(bcprov and bcpg) security vulnerability in IBM FileNet Content Manager(FNCM) reported for FileNet Deployment Manager(FDM)

Summary IBM FileNet Content ManagerFNCM 5.7.0-IF6 addresses multiple Bouncy Castle CVEs reported for FileNet Deployment ManagerFDM Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This iss...

Security update for libsodium

This update for libsodium fixes the following issues: Update to 1.0.22 jscPED-16890: Post-quantum key encapsulation is now available. ML-KEM768, the NIST-standardized lattice-based KEM, is accessible through the cryptokemmlkem768 functions. X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for...

SUSE-SU-2026:4368-1 Security update for libsodium

This update for libsodium fixes the following issues: Update to 1.0.22 jscPED-16890: Post-quantum key encapsulation is now available. ML-KEM768, the NIST-standardized lattice-based KEM, is accessible through the cryptokemmlkem768 functions. X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for...

CVE-2026-54723 devpi: Database contents leak

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verifyprimary does not reject a...

CVE-2026-54723 devpi: Database contents leak

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verifyprimary does not reject a...

Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities

Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.1...

PYSEC-2026-3803

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-81720 openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81720

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter found in identity file protection blocks. Because the value is passed unboundedly into Argon2 key derivation, an attacker with write access to local identity stores can craft a malicious identity file with an excessive memor...

CVE-2026-81720 openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81720 openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81721: Uncontrolled Resource Consumption

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-59648

A flaw was found in Bouncy Castle for Java. The OpenPGP Argon2 S2K Salted Key Derivation Function implementation allows a remote attacker to influence the amount of memory and passes used during key derivation. This can lead to a denial of service DoS by consuming excessive system resources, maki...

devpi-server may leak database contents

ImpactIf the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

CVE-2026-48084

OpenReception’s OpenReception appointment-booking software (versions prior to 1.0.2) does not rate-limit failed passphrase login attempts in /api/auth/login, unlike the WebAuthn path which triggers a per-account 429 throttle after ~19 attempts. The absence of throttling on the passphrase branch a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...