ATFuzzer

ATFuzzer "Opening Pandora's Box through ATFuzzer: Dynamic Analysis of AT Interface for Android Smartphones" принята к публикации на 35-й Ежегодной конференции по приложениям компьютерной безопасности ACSAC 2019. https://syed-rafiul-hussain.github.io/wp-content/uploads/2019/11/atfuzz.pdf Аннотация...

fb-sleep-stats

fb-sleep-stats: Использование Facebook для отслеживания сна ваших друзей Небольшой инструмент, демонстрирующий потенциальные угрозы конфиденциальности, которые несут современные социальные сети. Отслеживая статус «в сети/не в сети» пользователей Facebook, можно получить точную картину их режима...

leakish

Leakish 브라우저 개인정보 유출 탐지기 — 8가지 탐지 모듈, 위험 점수 평가, 그리고 계정별 기록을 모두 브라우저 안에서 제공합니다. Verdent로 제작 — 에이전트형 코딩 어시스턴트. 모든 탐지 모듈, 분석 대시보드, API 키 인증 흐름, 이중 언어 UI, 쿠버네티스 대응 Docker 이미지는 모두 Verdent가 주도한 페어 프로그래밍 세션에서 설계 및 구현되었습니다. 이 도구는 무엇인가 URL을 열고 모두 실행 을 클릭하면 몇 초 안에 Leakish는 브라우저가 당신과 당신의 네트워크에 대해 무엇을 유출하는지...

CVE-2026-24332

CVE-2026-24332 – Discord Invisible 모드 프레즌스 유출 요약 이 저장소는 Discord 클라이언트와 API에 영향을 미치는 미패치 프라이버시 침해 이슈인 CVE-2026-24332를 문서화합니다. 이 취약점은 외부 클라이언트가 Invisible 로 표시된 사용자가 실제로 온라인인지 판별할 수 있게 합니다. 세부 정보 CWE-200: 민감 정보 노출 CVSS: 4.3 Medium 상태: 미패치 2026년 기준 영향: 프라이버시 유출 Discord의 WebSocket 프레즌스 시스템은 Invisible...

Some cheap smart glasses are a security disaster

Apart from the privacy concerns around smart glasses, researchers have found that some cheap brands come with barely any security at all. ABC Australia reports that researchers from NSB Cyber and Abstract Shield tested two inexpensive pairs, costing A$60 and A$110 around US$42 and US$78, and foun...

Astra Linux – Vulnerability in Thunderbird, Firefox

A race condition could have led to private browsing tabs being opened in regular browsing windows. This could have resulted in a potential privacy breach. This vulnerability has been fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...

Exploit for CVE-2026-24332

CVE-2026-24332 – Discord Invisible Mode Presence Leak Summ...

SUSE CVE-2026-64713

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...

GHSA-JHH7-832H-F8HV WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

PT-2026-61626

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses...

Invoking Encrypted Client Hello privacy leak in crypto/tls

...

BIT-GOLANG-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-49256

CVE-2026-49256 (Discourse) concerns a leakage vulnerability where restricted tag names and tag-group names attached to publicly readable categories could be exposed to anonymous/unauthorized users via category and group endpoints. Affected versions include prior to 2026.6.0, 2026.5.1, 2026.4.2, a...

CVE-2026-42505

A flaw was found in the crypto/tls package in Go. Handshakes utilizing Encrypted Client Hello ECH could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link...

CVE-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-42505

Handshakes using Encrypted Client Hello can be de-anonymized by a passive network observer because pre-shared key identities are disclosed in the unencrypted client hello. This vulnerability affects the golang package and several related components, including runfinch-finch , amazon-cloudwatch-ag...

GO-2026-5856 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

EUVD-2026-40703

Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-14092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin dat...

Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...