CVE-2021-43798

CVE-2021-43798 CVE-2021-43798 es una vulnerabilidad marcada como prioridad Alta CVSS 7.5 que permite la lectura arbitraria de archivos a través de complementos instalados en la aplicación Grafana. Esta vulnerabilidad afecta a las versiones 8.0.0-beta1, 8.0.0 hasta 8.3.0. Probado solo en 8.2.0. El...

capture-the-flag

Capture The Flag! Remaster Linux Live CD images for the purpose of creating ready to use security wargames with pre-installed vulnerabilities to exploit. Requirements You will need the following in order to build the Live CD using the scripts in this project: Linux, with root access using sudo gi...

stego-toolkit

隐写工具集 该项目是一个 Docker 镜像，适用于解决 CTF 平台（如 hackthebox.eu）上的隐写挑战。该镜像预装了许多流行工具（见下方工具列表），以及一些可用于检查简单事物的筛选脚本（例如，运行 checkjpg.sh image.jpg 可获取 JPG 文件的报告）。 使用方法 首先确保您已安装 Docker（安装指南）。然后您可以使用此仓库中的 shell 脚本 bin/build.sh 和 bin/run.sh 来构建镜像并运行容器。您将进入容器内的 bash shell。容器将挂载 data 文件夹，您可以将待分析的文件放入其中。 如果您不使用脚本，请按以下步骤操...

umap

umap - the USB host security assessment tool Based on Facedancer by Travis Goodspeed: http://goodfet.sourceforge.net/hardware/facedancer21/ Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com...

ZimaOS <= v1.2.4 - Sensitive Information Disclosure

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...

DEBIAN-CVE-2026-106405

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. Chromium security severity: Medium...

CVE-2026-106254

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

CVE-2026-106254

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

EUVD-2026-93584

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

PT-2026-106927

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox and Thunderbird

Using XMLHttpRequest, an attacker could identify installed applications by probing error messages related to loading external protocols. This vulnerability affects Thunderbird version 91.4.0, Firefox ESR version 91.4.0, and Firefox version 95...

CVE-2026-104447

Versions of YesWiki before 4.6.7 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the autoupdate UpdateAction . The root cause is the use of unprotected GET requests , which allows an attacker to delete installed packages. By luring a logged-in administrator to a crafted...

PT-2026-104257

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

BIT-COMPOSER-2026-59944 Composer: CVE-2026-59946 fix bypass via symlinked package bin path

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

AZL-101250 CVE-2026-90007 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...

CVE-2026-91717

A missing authorization flaw was found in the Android component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=549225472...

CVE-2026-91717

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

DEBIAN-CVE-2026-91717

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

CVE-2026-91717

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...

EUVD-2026-79971

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...