ail-typo-squatting

ail-typo-squatting ail-typo-squatting è una libreria Python per generare un elenco di potenziali domini typosquatting con un motore di permutazione dei nomi di dominio, per alimentare AIL e altri sistemi. Lo strumento può essere utilizzato come strumento autonomo o per alimentare altri sistemi. S...

CVE-2026-108267 Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...

Malicious Package

Overview asepxyznew is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview media-manager5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @library-wide/library-shell is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @galicia-toolkit-nestjs/paas is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CLSA-2026-1791571542 TuxCare security update for @xmldom/xmldom (1 CVE)

TuxCare rebuilt @xmldom/xmldom to address 1 CVE. Fixed in 0.9.8-tuxcare.4...

MGASA-2026-0481 Updated openssl package fixes security vulnerabilities

DTLS Retransmits Handshake Messages From a Stale Buffer Offset. CVE-2026-84782 Excessive Memory Allocation in Relative CRLDP Processing. CVE-2026-35189 QUIC Unvalidated Amplification Credit may be Over Accounted. CVE-2026-35191 Potential CPU DoS via On^2 Fragment Reassembly in QUIC. CVE-2026-4277...

arp-dns-spoof

Installationon Debian-based Linux Distribution Install Scapy % sudo apt-get install tcpdump graphviz imagemagick python-gnuplot python-crypto python-pyx % pip install scapy Install python-NetfilterQueue % sudo apt-get install build-essential python-dev libnetfilter-queue-dev % git clone...

CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +22381 more potentially affected by CVE-2026-108106 via org.xerial.snappy:snappy-java (>=1.0.5, <=1.1.10.8)

org.xerial.snappy:snappy-java MAVEN version =1.0.5, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2026-108106 Source advisory: MEND:CVE-2026-108106...

Reusing a Nonce, Key Pair in Encryption

Overview Affected versions of this package are vulnerable to Reusing a Nonce, Key Pair in Encryption in the native one-shot CTR packet path ctrpcprocesspacket, which does not check that the request fits the addressable block range and reports the full input length as a success even once the block...

CLSA-2026-1791549508 TuxCare security update for org.freemarker:freemarker (1 CVE)

TuxCare rebuilt org.freemarker:freemarker to address 1 CVE. Fixed in 2.3.34-tuxcare.1...

CLSA-2026-1791547948 TuxCare security update for io.projectreactor.netty (5 CVEs)

TuxCare rebuilt 4 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5...

ROOT-OS-DEBIAN-13-CVE-2025-15366 CVE-2025-15366 in python3.13 - Patched by Root

Root has patched CVE-2025-15366 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-19445 CVE-2026-19445 in python3.13 - Patched by Root

Root has patched CVE-2026-19445 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

BIT-THRIFT-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94639 Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

BIT-THRIFT-2026-66837 Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length

Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...