fwknop

fwknop - 단일 패킷 인증 SPA 소개 fwknop은 강력한 서비스 은닉을 위해 SPASingle Packet Authorization로 알려진 인증 방식을 구현합니다. SPA는 방화벽 뒤에서 기본적으로 패킷을 차단default-drop하는 상태에서 서비스에 대한 원하는 접근을 통신하기 위해 암호화되고 재전송이 불가능하며 HMAC을 통해 인증되는 단일 패킷만을 필요로 합니다. SPA의 주요 용도는 방화벽을 사용하여 SSH와 같은 서비스에 대한 모든 연결 시도를 차단함으로써 취약점0-day 및 패치되지 않은 코드 모두의 악...

DNSnitch

DNSnitch 免责声明 这个工具是我自己用的，如果有人需要的话就放在这里。如果你发现 bug，欢迎提交 issue！ 交互式终端 DNS 防火墙 DNSnitch 是一个本地、隐私优先的 DNS 服务器，让你完全掌控自己的网络流量。与被动屏蔽列表不同，DNSnitch 采用“默认拒绝”理念：所有未知域名默认被阻止，直到你通过实时终端仪表板授权。 主要特性 实时拦截 ：本地运行（端口 5353，可配置）以捕获离开你机器的每一个 DNS 请求。 默认拒绝策略 ：未知域名立即返回 NXDOMAIN，并出现在“待处理队列”中。 4 级权限系统 : 永久 : 永久加入白名单。 临时 : 允许 ...

BlockGuard

🛡️ BlockGuard — 프로세스 기반 파일 접근 보안 에이전트 BlockGuard 는 Windows 데이터 손실 방지DLP 에이전트로, 프로세스 수준에서 파일 접근을 가로채고 제어합니다. 실행 파일 경로, 암호화 해시, Authenticode 서명, 무결성 수준integrity level 으로 식별되는 인가된 프로세스 만이 보호된 파일을 읽을 수 있도록 보장합니다. 다른 모든 프로세스는 NTFS ACL을 통해 OS 커널 수준에서 기본적으로 거부됩니다. 📑 목차 기능 아키텍처 UI 관리 인터페이스 사전 요구 사항 빠른 시작...

iron-proxy

iron-proxy The problem CI jobs, AI coding agents, and sandboxed containers can make arbitrary outbound requests. A compromised dependency, a prompt injection, or a malicious build step can exfiltrate secrets, phone home, or open a reverse shell. Most teams have zero visibility into what's leaving...

CVE-2026-42596

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as...

CVE-2026-42596 Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as...

PT-2026-39661

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.32.0 Description Gotenberg is a Docker-powered stateless API for PDF files. The Chromium URL-to-PDF endpoint '/forms/chromium/convert/url' lacks default protection against Server-Side Request Forgery SSRF for HTTP...

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Summary The default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://::ffff:127.0.0.1:... and reach loopback or private HTTP services that the...

GHSA-4VMC-GM8V-M35H Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Summary The default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://::ffff:127.0.0.1:... and reach loopback or private HTTP services that the...

PT-2026-38386

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.31.0 Description An unauthenticated attacker can bypass the default deny-lists used by the downloadFrom and webhook features. The issue occurs because the filtering logic uses case-sensitive regular expressions th...

CVE-2026-41081 Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication the default configuration, the...

EUVD-2026-15413

A use-after-return vulnerability exists in the named server when handling DNS queries signed with SIG0. Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly mismatch an IP address. In a default-allow ACL denying only specific IP addresses, this may lead to...

CVE-2026-3591

A use-after-return vulnerability exists in the named server when handling DNS queries signed with SIG0. Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly mismatch an IP address. In a default-allow ACL denying only specific IP addresses, this may lead to...

UBUNTU-CVE-2026-3591

A use-after-return vulnerability exists in the named server when handling DNS queries signed with SIG0. Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly mismatch an IP address. In a default-allow ACL denying only specific IP addresses, this may lead to...

CVE-2025-13357

Vault’s Terraform Provider has a vulnerability (CVE-2025-13357) where the default deny_null_bind parameter for the LDAP authentication method was set to false, potentially allowing anonymous/unauthenticated binds and authentication bypass. Concrete details across sources indicate this affects the...

EUVD-2025-175367

The issue was addressed by refusing external connections by default. This issue is fixed in Compressor 4.11.1. An unauthenticated user on the same network as a Compressor server may be able to execute arbitrary code...

CLSA-2025-1757076749 Fix CVE(s): CVE-2025-54574

SECURITY UPDATE: Disable URN protocol access to prevent potential security vulnerabilities - debian/patches/CVE-2025-54574.patch: Add ACL rules to deny URN protocol access by default - CVE-2025-54574...

Linux Distros Unpatched Vulnerability : CVE-2021-36213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing th...

Linux Distros Unpatched Vulnerability : CVE-2018-12550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Eclipse Mosquitto version 1.0 to 1.5.5 inclusive is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, th...

Linux Distros Unpatched Vulnerability : CVE-2019-12291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by ...