spyre

Spyre ...un escáner modular autónomo y simple de IOC basado en host Spyre es un escáner simple de IOC basado en host, construido alrededor del motor de coincidencia de patrones YARA y otros módulos de escaneo. El objetivo principal de este proyecto es facilitar la operacionalización de reglas YAR...

the-bastion

🔒 The Bastion Resumen Los bastiones son un clúster de máquinas utilizadas como punto de entrada único por los equipos operativos como administradores de sistemas, desarrolladores, administradores de bases de datos, ... para conectarse de forma segura a dispositivos servidores, máquinas virtuales,...

webanalyze

webanalyze Esta es una adaptación de Wappalyzer en Go. Esta herramienta está diseñada para ser eficiente y permite probar listas enormes de hosts. !NOTE Debido a que Wappalyzer eliminó el acceso público a sus definiciones de aplicaciones, webanalyze actualmente carga las definiciones desde enthec...

CVE-2026-19935 Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

The Bluetooth LE host queues received L2CAP connection-oriented channel CoC data for deferred processing through a struct kwork embedded in the channel object lechan-rxwork, handler l2caprxprocess whenever the channel uses a dynamic PSM 0x0080-0x00FF. Channel teardown in l2capchandestroy in...

CVE-2026-19935 Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

The Bluetooth LE host queues received L2CAP connection-oriented channel CoC data for deferred processing through a struct kwork embedded in the channel object lechan-rxwork, handler l2caprxprocess whenever the channel uses a dynamic PSM 0x0080-0x00FF. Channel teardown in l2capchandestroy in...

CVE-2026-19935

The Zephyr Bluetooth host is vulnerable to a use-after-free flaw in the L2CAP connection-oriented channel (CoC) object. When using a dynamic PSM (0x0080-0x00FF), the system queues received data for deferred processing via a k_work item. However, during channel teardown in l2cap_chan_destroy(), th...

CVE-2026-19935 Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

The Bluetooth LE host queues received L2CAP connection-oriented channel CoC data for deferred processing through a struct kwork embedded in the channel object lechan-rxwork, handler l2caprxprocess whenever the channel uses a dynamic PSM 0x0080-0x00FF. Channel teardown in l2capchandestroy in...

uncover

Descubre rápidamente hosts expuestos en internet usando múltiples motores de búsqueda. Características • Instalación • Uso • Configuración • Ejecutar Uncover • Unirse a Discord uncover es un wrapper en Go que utiliza APIs de motores de búsqueda conocidos para descubrir rápidamente hosts expuestos...

ossec-hids

Información sobre OSSEC OSSEC es una plataforma completa para monitorear y controlar tus sistemas. Combina todos los aspectos de HIDS detección de intrusiones basada en host, monitoreo de registros y SIM/SIEM en una solución simple, potente y de código abierto. Visita nuestro sitio web para obten...

CLSA-2026-1791735057 flatpak: Fix of CVE-2026-96807

CVE-2026-96807: regenerateldcache created and bind-mounted the per-app .ld.so directory by path, and flatpakswitchsymlinkandremove swapped its "active" symlink with path-based symlink/rename/unlink, so a sandboxed app could replace /.var/app/$APPID/.ld.so with a symlink and have ld.so cache files...

Malicious code in another-very-long-name (npm)

Source: amazon-inspector eea9e3cf3d973c07d09048435d4ddc496574ce222d650c228b1400d866ea3ccf [email protected] ships a beacon.cjs that is invoked both from the declared postinstall lifecycle script and from the module's require-time entry index.js. On execution it collects host identifier...

Malicious code in nested-lib (npm)

Source: amazon-inspector 0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928 The package declares scripts.postinstall = "node beacon.cjs" and index.js also invokes require'./beacon.cjs'.fire at module load. beacon.cjs POSTs a JSON payload containing os.hostname, dirname, process.cwd,...

Malicious code in @coopeuch/core (npm)

Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home directory, platform/arch/release, CPU and memory, DNS servers,...

Malicious code in @s4yhiitestpoc/r3-https (npm)

Source: amazon-inspector b2638f8970897121676d5dc3ed7c002ab9d9ccc3e400283e165297a95e3c1423 On npm install, postinstall.js automatically collects host identity hostname, username, uid/gid, homedir, platform, release, enumerates network interfaces addresses, MACs, CIDRs, reads DNS servers and intern...

Malicious code in @s4yhiitestpoc/scan-https-d (npm)

Source: amazon-inspector 1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea On npm install, postinstall.js collects installer host identity — os.hostname, os.userInfo.username, home directory, cwd, non-internal network interface addresses, DNS servers, and platform/arch/release — an...

CVE-2026-108905

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108905

Versions of pH7Builder (pH7 Social Dating CMS) prior to 18.6.0 are vulnerable to a hard-coded API key flaw in Tool.class.php . Unauthenticated attackers can bypass API access checks by spoofing the Host header (e.g., Host: localhost) while providing the hard-coded key private_api_key=dev772277. T...

CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...