CVE-2026-103546

The MongoDB Controllers for Kubernetes are vulnerable to improper validation of Ops Manager backup configuration . An attacker with permissions to modify an OpsManager custom resource can trigger unintended administrative changes in Ops Manager. This vulnerability specifically impacts deployments...

tools-python

用于解析、验证和创建 SPDX 文档的 Python 库 CI 状态（Linux、macOS 和 Windows）： 破坏性变更 v0.7 - v0.8 请注意，即将发布的 0.8 版本为迎接即将到来的 SPDX v3.0 版本进行了重大重构，导致 API 出现破坏性变更。 请参考 迁移指南 来更新您现有的代码。 v0.8 的主要特性包括： 针对 v2.2 和 v2.3 规范对 SPDX 文档进行全面验证 支持 SPDX 的 RDF 格式，并包含所有 v2.3 特性 对即将推出的 SPDX v3 规范的实验性支持。但请注意，目前该支持既不完整也不稳定，因为该规范仍在演进中。与 SPDX3...

CVE-2026-104964

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

jvmxray

JVMXRay: Java Application Security Monitoring Duke history Documentation | Changes from Upstream | Project Blog JVMXRay monitors Java applications in real-time via bytecode injection, detecting vulnerabilities and suspicious activity without code changes. 19 modular sensors track file access,...

kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

lunar

LUNAR Lockdown UNix Auditing and Reporting Version Current version 16.6.1 Refer to lunar.sh and CHANGELOG.md for more up to date version information License CC BY-NC-SA: https://creativecommons.org/licenses/by-nc-sa/4.0/ Fund me here: https://ko-fi.com/richardatlateralblast NOTICE Run this code i...

get-pixels-updated

这是get-pixels的更新版本，修复了CVE-2020-8175安全问题。创建时，除package.json外，每个文件均与原仓库相同。 get-pixels-updated 以下内容来自get-pixels的GitHub页面。如前所述，此仓库无破坏性更改，且与原仓库几乎完全相同。 给定一个URL或路径，获取图像中的所有像素，并以ndarray形式返回结果。100%纯JavaScript编写，在browserify和node.js中均可运行，且无外部原生依赖。 目前支持以下文件格式： PNG JPEG GIF 示例 var getPixels =...

Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes. id: CVE-2019-17228 info: name: Motors Car Dealer & Classified Ads = 1.4.0 - Unauthenticated settings...

exploit_mitigations

Exploitation Mitigations The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the...

WordPress OneTone theme <= 3.0.6 – Unauthenticated Options Changes

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes. id: CVE-2019-17230 info: name: WordPress OneTone theme = 3.0.6 – Unauthenticated Options Changes author: daffainfo severity: medium description: | includes/theme-functions.php in...

CVE-2013-3900_Remediation_PowerShell

CVE-2013-3900修复PowerShell 用于修改注册表以修复CVE-2013-3900的脚本。它提供了撤销选项，以防对您的环境造成影响。 步骤 下载脚本，以管理员权限运行，然后重启机器。...

Invoke-DCSync

Invoke-DCSync Invoke-DCSync 参考：https://adsecurity.org/?p=1729 参考：https://silentbreaksecurity.com/invoke-dcsync-because-we-all-wanted-it/ 目标：使用 mimikatz DCSync 功能从域控制器检索所有用户账户的密码哈希 警告：仅在实验环境中执行此操作。 mimikatz 实现了一个名为 DCSync 的工具，这使 mimikatz 能够模拟域控制器，并尝试从另一个域控制器检索所有密码哈希。 你可能需要禁用 Windows Defender...

security_monkey

NOTE: Security Monkey is in maintenance mode and will be end-of-life in 2020. For AWS users, please make use of AWS Config. For GCP users, please make use of Cloud Asset Inventory. Security Monkey Security Monkey monitors your AWS and GCP accounts for policy changes and alerts on insecure...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

fastify vulnerable to request body replacement via an async validation result collision

Impact Fastify runs a route's validator and, for a result shaped like value, error , unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers for example Joi. A JSON Schema $async validator, however, resolv...

EUVD-2026-70984

fastify vulnerable to request body replacement via an async validation result collision...

CVE-2026-102129

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...

CVE-2026-76731

An authentication bypass vulnerability exists in the captive portal of HPE Networking Instant On . This flaw could allow an unauthenticated remote attacker to circumvent existing authentication controls. If successfully exploited, the attacker could gain limited access to some data and perform li...

CVE-2026-102437

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...