ATFuzzer

ATFuzzer 「ATFuzzerによるパンドラの箱を開ける：Androidスマートフォン向けATインターフェースの動的解析」は、第35回ACSAC（2019年）に採択されました。 https://syed-rafiul-hussain.github.io/wp-content/uploads/2019/11/atfuzz.pdf 概要...

fb-sleep-stats

fb-sleep-stats: Facebookを使って友達の睡眠を追跡する 現代のソーシャルメディアが抱えるプライバシー上の潜在的な影響を示す小さなツールです。Facebook上のユーザーのオンライン/オフラインステータスを追跡することで、その人の睡眠パターンを正確に把握することが可能になります。 ブログ記事を読む: https://medium.com/@sqrendk/how-you-can-use-facebook-to-track-your-friends-sleeping-habits-505ace7fffb6 インストール 前提条件 Git インストール方法 Node.js...

leakish

Leakish 浏览器隐私泄露检测器 — 包含八个检测模块、风险评分和每账户历史记录，全部集成于浏览器中。 基于Verdent 构建 — 一个智能编码助手。 每一个检测模块、分析仪表板、API密钥认证流程、双语界面以及支持Kubernetes的Docker镜像，均通过Verdent驱动的结对编程会话设计并实现。 这是什么 打开一个 URL，点击 运行全部 ，几秒钟内 Leakish 就会告诉你浏览器通过 WebRTC、指纹 API、DNS 以及服务器端探测泄露了哪些关于你和网络的信息。八个独立模块各自输出类型化结果及风险信号，一个聚合评分（0–100）和级别（安全 / 警告 / 严重）。...

CVE-2026-24332

CVE-2026-24332 – Discord 隐身模式在线状态泄露 摘要 本仓库记录了 CVE-2026-24332，这是一个影响 Discord 客户端和 API 的未修复隐私问题。 该漏洞允许外部客户端判断被标记为 Invisible （隐身）的用户是否实际在线。 详情 CWE-200：敏感信息暴露 CVSS：4.3（中危） 状态：未修复（截至 2026 年） 影响：隐私泄露 Discord 的 WebSocket 在线状态系统会将隐身用户包含在 presences 数组中，而真正离线的用户则会被 排除在外。这一差异使得攻击者能够推断出用户真实的在线状态，即使用户试图隐藏它。 影...

Some cheap smart glasses are a security disaster

Apart from the privacy concerns around smart glasses, researchers have found that some cheap brands come with barely any security at all. ABC Australia reports that researchers from NSB Cyber and Abstract Shield tested two inexpensive pairs, costing A$60 and A$110 around US$42 and US$78, and foun...

Astra Linux – Vulnerability in Thunderbird, Firefox

A race condition could have led to private browsing tabs being opened in regular browsing windows. This could have resulted in a potential privacy breach. This vulnerability has been fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...

Exploit for CVE-2026-24332

CVE-2026-24332 – Discord Invisible Mode Presence Leak Summ...

SUSE CVE-2026-64713

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...

GHSA-JHH7-832H-F8HV WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

PT-2026-61626

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses...

Invoking Encrypted Client Hello privacy leak in crypto/tls

...

BIT-GOLANG-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-49256

CVE-2026-49256 (Discourse) concerns a leakage vulnerability where restricted tag names and tag-group names attached to publicly readable categories could be exposed to anonymous/unauthorized users via category and group endpoints. Affected versions include prior to 2026.6.0, 2026.5.1, 2026.4.2, a...

CVE-2026-42505

A flaw was found in the crypto/tls package in Go. Handshakes utilizing Encrypted Client Hello ECH could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link...

CVE-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-42505

Handshakes using Encrypted Client Hello can be de-anonymized by a passive network observer because pre-shared key identities are disclosed in the unencrypted client hello. This vulnerability affects the golang package and several related components, including runfinch-finch , amazon-cloudwatch-ag...

GO-2026-5856 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

EUVD-2026-40703

Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-14092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin dat...

Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...