CVE-2026-93317

The buildkit software (referenced via the Moby project) is vulnerable to a flaw where an unauthenticated attacker controlling a registry or OCI-layout blob source can provide blob contents that do not match the claimed digest. This allows the resulting snapshot to be cached under the incorrect di...

CVE-2026-93317 Container blob cache can accept unverified content

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

EUVD-2026-92529

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

ClickOnceBlobber

Kit de Inyección AppDomainManager para ClickOnce Armar aplicaciones .NET ClickOnce firmadas para acceso inicial mediante el secuestro de una DLL dependiente a través de inyección AppDomainManager y la carga de un puerto C del Agente ProxyBlob. Incluye un puerto C de ProxyBlob — un proxy SOCKS5 qu...

goblob

Goblob 🫐 Goblob 是一款轻量且快速的枚举工具，旨在帮助发现 Azure Blob 中公开暴露的敏感信息，可用于漏洞评估、渗透测试和情报收集等各种研究目的。 警告 。Goblob 会为每个存储账户中的每个容器名称生成独立的协程，仅受 -goroutines 参数指定的最大并发协程数限制。在大多数情况下，使用默认词表时，这种实现方式会迅速耗尽带宽，或者如果您在云环境中使用该工具，可能会产生高昂的费用。运行该工具前，请确保您清楚自己在做什么。 安装 go install github.com/Macmod/goblob@latest 用法 使用 goblob 只需运行以下命令： ...

Cobaltstrike_BOFLoader

CobaltstrikeBOFLoader Esta es una adaptación/reimplementación de código abierto del Cobalt Strike BOF Loader tal cual. En su mayor parte, todo se hace como en el Beacon + Teamserver original en Cobalt Strike. Esto incluye deficiencias que se resuelven en otros cargadores COFF de código abierto co...

bcm4360-wpa3

在 Broadcom BCM4360（封闭的 wl blob）上实现 WPA3-SAE + 802.11w Apple/Broadcom 从未为 BCM4360 14e4:43a0 提供 WPA3。其唯一的 Linux 驱动是封闭的 broadcom-sta wl blob；brcmfmac 无法驱动它。本项目为这一封闭 blob 添加了 WPA3-SAE + 完整 802.11w PMF —— 完全通过主机软件实现，无需固件源码 。 已在空中与仅支持 WPA3、要求 MFP 的 AP 验证：SAE 认证 → 关联 → 四次握手 → CCMP 数据，稳定运行，并能抵抗 去认证洪水 和...

etherblob-explorer

EtherBlob Explorer 使用 Etherscan.io API 在以太坊网络上搜索和提取 blob 文件。 简介 EtherBlob Explorer 是一款面向研究人员、分析师、CTF 玩家或任何充满好奇、希望在以太坊区块链网络上搜索各种文件或有意义的人工提供数据的工具。它能在用户指定的区块 ID 范围或 UNIX 时间戳内，在 5 个可用网络（MainNet、Görli、Kovan、Rinkeby 和 Ropsten）中的任意一个上进行搜索。 关于真实案例，你可以阅读 2017 年进行的这个实验。区块链的不可变性确实是一把双刃剑。 安装 运行以下命令： $ pip...

BlobHunter

BlobHunter 一个用于扫描Azure Blob存储账户中公开Blob的开源工具。 BlobHunter是 Hunting Azure Blobs Exposes Millions of Sensitive Files 研究的一部分。 概述 BlobHunter可帮助您识别那些存储了任何有互联网连接的人均可公开访问的文件的Azure Blob存储容器。 该工具通过识别配置不当且存储敏感数据的容器来帮助降低风险，在存在大量难以跟踪的存储账户的大型Azure订阅中尤其有用。 BlobHunter会生成一份信息丰富的CSV结果文件，其中包含扫描环境中每个公开容器的重要详细信息。 要求 1...

azure-pentesting-suite

azure-pentesting-suite azpt 🚧 Beta pública. azpt está en desarrollo activo — los comandos, flags y formatos de salida aún pueden cambiar entre versiones. Los informes de errores y comentarios son bienvenidos a través de los issues de GitHub. azpt es un toolkit de Go para evaluaciones de seguridad...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload es un toolkit de Smuggling HTML para generar páginas HTML que incrustan y reconstruyen archivos usando JavaScript. Proporciona múltiples métodos de Smuggling HTML , opciones de codificación de payloads, variaciones de JavaScript y varias plantillas HTML integrada...

gMSA_Dumper

gMSADumper Lee cualquier blob de contraseña de gMSA al que el usuario pueda acceder y analiza los valores. gMSADumper.py -h...

Rocky Linux 8 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource (crlsa-2026_24545)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202624545 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource / libyang-devel / etc (crlsa-2026_25051)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625051 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

Rocky Linux 10.2 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource / libyang-devel / etc (crlsa-2026_24758)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202624758 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

CVE-2025-10681

CVE-2025-10681: Clave de cuenta de Azure Blob Storage embebida Aviso Campo| Valor ---|--- CVE| CVE-2025-10681 ICSA| ICSA-26-055-03 CVSS 3.1| 8.6 Alto Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE| CWE-798 Uso de credenciales embebidas Investigador| Michael Groberman — Gr0m Publicado|...

CVE-2026-55726

CVE-2026-55726: Publicly Listable Azure Blob Storage Container device logs Advisory Field| Value ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0|...

CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-blob...

Missing Authorization

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Missing Authorization in the getClientUploadRoute handler for the client-upload path. An attacker can upload files by sending a client upload request t...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...