Sliver is Vulnerable to Authenticated Nil-Pointer Dereference through its Handlers

Executive Summary A vulnerability exists in the Sliver C2 server's Protobuf unmarshalling logic due to a systemic lack of nil-pointer validation. By extracting valid implant credentials and omitting nested fields in a signed message, an authenticated actor can trigger an unhandled runtime panic...

GHSA-HX52-CV84-JR5V Sliver is Vulnerable to Authenticated Nil-Pointer Dereference through its Handlers

Executive Summary A vulnerability exists in the Sliver C2 server's Protobuf unmarshalling logic due to a systemic lack of nil-pointer validation. By extracting valid implant credentials and omitting nested fields in a signed message, an authenticated actor can trigger an unhandled runtime panic...

WordPress plugin Global Logistics 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-23300

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Global Logistics globallogistics allows PHP Local File Inclusion.This issue affects Global Logistics: from n/a through = 3.20...

PT-2026-23602

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.3 Description Gokapi is a self-hosted file sharing server that supports automatic expiration and encryption. The upload status Server-Sent Events SSE implementation on the /uploadStatus API endpoint publishes globa...

CLSA-2026-1772645603 Update of ca-certificates

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go Daddy Class 2 CA" - Certificate "Starfield Class...

CLSA-2026-1772644297 Update of ca-certificates

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go Daddy Class 2 CA" - Certificate "Starfield Class...

Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

In this article 1. Operational overview of Tycoon2FA 2. Mitigation and protection guidance 3. Microsoft Defender detections Following its emergence in August 2023, Tycoon2FA rapidly became one of the most widespread phishing-as-a-service PhaaS platforms, enabling campaigns responsible for tens of...

Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

In this article 1. Operational overview of Tycoon2FA 2. Mitigation and protection guidance 3. Microsoft Defender detections Following its emergence in August 2023, Tycoon2FA rapidly became one of the most widespread phishing-as-a-service PhaaS platforms, enabling campaigns responsible for tens of...

SUSE-SU-2026:20653-1 Security update for cockpit

This update for cockpit fixes the following issues: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global prototypes bsc1257324...

SUSE-SU-2026:20695-1 Security update for cockpit-machines

This update for cockpit-machines fixes the following issues: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global prototypes bsc1257325...

MiracleLinux 9 : freerdp-2.11.7-1.el9_7.2 (AXSA:2026-233:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-233:05 advisory. freerdp: FreeRDP heap-buffer-overflow CVE-2026-22855 freerdp: FreeRDP global-buffer-overflow CVE-2026-22858 freerdp: FreeRDP heap-buffer-overflow...

SUSE-SU-2026:20650-1 Security update for cockpit-machines

This update for cockpit-machines fixes the following issues: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global prototypes bsc1257325...

BIT-DISCOURSE-2026-28219 Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper authorization check in the topic management logic allows authenticated users to modify privileged attributes of their topics. By manipulating specific parameters in a PUT or POST...

Malicious Package

Overview @global-dax-ad-platform/dax-styles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @global-dax-ad-platform/dax-types is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

MAL-2026-1167 Malicious code in @global-dax-ad-platform/dax-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eb4c0cce0e997a5ceaf51dd24ec685c500bbfe904265afdce79bb5b2f7e0033 The package @global-dax-ad-platform/dax-modules was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1169 Malicious code in @global-dax-ad-platform/dax-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 465668b4ba6f4c109320a3407a4db8d254d21a7f43af75ca5f8c1873c12c7f46 The package @global-dax-ad-platform/dax-types was found to contain malicious code. Source: ghsa-malware...

Malicious code in @global-dax-ad-platform/dax-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e50b13916c14b17a01e550d32711ed37f8842bc2a0eede3ea254df64f7a0af1a The package @global-dax-ad-platform/dax-components was found to contain malicious code. Source: ghsa-malware...

Malicious code in @global-dax-ad-platform/dax-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eb4c0cce0e997a5ceaf51dd24ec685c500bbfe904265afdce79bb5b2f7e0033 The package @global-dax-ad-platform/dax-modules was found to contain malicious code. Source: ghsa-malware...