EUVD-2026-103293

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

GetBlocked

GetBlocked! Cleaner pages. Fewer trackers. Local-only. GetBlocked! is a lightweight, local-only Chrome extension that helps reduce common third-party website tracking by blocking known tracker requests, cleaning tracking links, and explaining tracking attempts. An optional experimental Decoy Mode...

Artemis

Artemis Overview A tools for Find APK Infrastructure . Brought to you by: HADESS performs offensive cybersecurity services through infrastructures and software that include vulnerability analysis, scenario attack planning, and implementation of custom integrated preventive projects. We organized...

CVE-2026-111926

The Coder software versions 2.10.0 through 2.34.8 are vulnerable to an information disclosure flaw. An unauthenticated agent debug HTTP server listening on 127.0.0.1:2113 contains a /debug/manifest handler that returns the full agent manifest. This manifest includes sensitive template-provided en...

springhound

springhound Created after the release of CVE-2022-22965 and CVE-2022-22963. Bash script that detects Spring Framework occurrences in your projects and systems, allowing you to get insight on versions used. Unpacks JARs and analyzes their Manifest files. Usage: ./springhound.sh rootdirectory...

truegaze

truegaze A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only...

tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

neto

Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...

uacscript

UAC Bypass Vulnerability in Windows Script Host The Windows Script Host executables suffer from a vulnerability due to a missing embedded manifest. Using another exploit, the combination of "wusa.exe" and "makecab.exe" files can be copied to the Windows folder. Copies of a manifest and the script...

CVE-2026-64633

CVE-2026-64633 Analysis Payloads Files payloads/ — generated payload documents treatment + control variants payloads/manifest.json — payload manifest with pids / pairs...

PT-2026-115848

Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...

go-pillage-registries

go-pillage-registries This project takes a Docker registry and pillages the manifest and configuration for each image in its catalog. It uses Google's crane command's package, which should follow docker's keychain semantics. If you would like to override this, just change authn.DefaultKeychain as...

EUVD-2026-99225

Distribution: Client manifests.Get does not verify returned content against requested digest...

vex-repo-spec

VEX Repository Specification v0.1 VEX Repository Specification v0.1 1. Versioning 2. Repository Manifest 2.1 Overview 2.2 File Location 2.3 Schema 2.4 Example 2.5 Field Descriptions and Usage Notes Main Fields Versions Subfields Locations Subfields 3. Repository Structure 3.1 File Structure 3.2...

Ollama - Remote Code Execution

Ollama before 0.1.34 does not validate the format of the digest sha256 with 64 hex digits when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring. id: CVE-2024-37032 info: name: Ollama ...

CVE-2026-85747

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

CVE-2026-95839

Impact A bug in containerd's image manifest processing causes an unrecovered panic when a child descriptor contains the "io.containerd.manifest.subject" annotation and a malformed digest. Pulling or importing such an image through the transfer service including default CRI "PullImage" requests...

Linux Distros Unpatched Vulnerability : CVE-2026-85747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a...

DEBIAN-CVE-2026-85747

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

CVE-2026-85747

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...