SilentButDeadly

SilentButDeadly Overview SilentButDeadly is a network communication blocker specifically designed to neutralize EDR/AV software by preventing their cloud connectivity using Windows Filtering Platform WFP. This version focuses solely on network isolation without process termination. Blog:...

Characterization-and-Detection-of-Cross-Router-Covert-Channels

Characterization and Detection of Cross-Router Covert Channels This repository contains the source code used in the paper "Characterization and Detection of Cross-Router Covert Channels". To access the paper, go to Dr. Oren's laboratory website: orenlab. The full data used in the paper is...

isowall

isowall Este es un mini-cortafuegos que aísla por completo un dispositivo objetivo de la red local. Esto sirve para permitir a máquinas infectadas acceso a Internet, pero sin poner en peligro la red local. Compilación Este proyecto depende de libpcap y, por supuesto, de un compilador de C. En...

isowall

isowall This is a mini-firewall that completely isolates a target device from the local network. This is for allowing infected machines Internet access, but without endangering the local network. Building This project depends upon libpcap, and of course a C compiler. On Debian, the following shou...

EUVD-2026-69716

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...

CVE-2026-76851

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...

CVE-2026-76851

A Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server allowed remote code execution on the instance. The root cause was insufficient network isolation that permitted malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests ...

CVE-2026-76851 Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...

PT-2026-84532

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A Server-Side Request Forgery SSRF issue exists where insufficient network isolation allows malicious pre-receive hook code to impersonate an internal service. This enables the...

Johnson Controls Inc. TL280

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

Panduit IntraVUE

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling. 2. RECOMMENDED PRACTICES CISA recommends users...

PYSEC-2026-2627 MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access

Impact Server-Side Request Forgery SSRF: A security vulnerability exists in the mcp-run-python tool specifically within the Pydantic-AI integration due to an overly permissive Deno sandbox configuration. The tool configures the Deno runtime—which is intended to isolate the execution of untrusted...

ST Engineering iDirect iQ-Series Terminals (Update A)

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these...

SUSE CVE-2026-13318

A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...

Delta Electronics DTM Soft

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system...

Protection Mechanism Failure

Overview praisonai is a PraisonAI TypeScript AI Agents Framework - Node.js, npm, and Javascript AI Agents Framework Affected versions of this package are vulnerable to Protection Mechanism Failure through the SandboxExecutor process in network-isolated mode, which fails to enforce true network...

GHSA-GQMF-56H7-RRPF npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

Summary The published npm package praisonai exports a TypeScript SandboxExecutor with a network-isolated mode. The CLI lists that mode as: text network-isolated No network access proxy blocked The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced...

AzeoTech DAQFactory (Update A)

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to upload malicious .ctl files that may lead to arbitrary code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...

GHSA-83PC-3RW9-QPWJ Deno: WebSocket API sandbox bypass via missing post-DNS check

Summary When a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a...

Deno: `fetch()` API sandbox bypass via missing DNS resolution check

Summary When fetch was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP,...