leakish

Leakish Browser privacy-leak detector — eight detection modules, risk scoring, and per-account history, all in your browser. Built withVerdent — an agentic coding assistant. Every detection module, the analytics dashboard, the API-key auth flow, the bilingual UI and the Kubernetes-ready Docker...

ATFuzzer

ATFuzzer "Opening Pandora's Box through ATFuzzer: Dynamic Analysis of AT Interface for Android Smartphones" is accepted to the 35th Annual Computer Security Applications Conference ACSAC 2019. https://syed-rafiul-hussain.github.io/wp-content/uploads/2019/11/atfuzz.pdf Abstract This paper focuses ...

fb-sleep-stats

fb-sleep-stats: Using Facebook to track your friends' sleep A small tool to show the potential privacy implications modern social media have. By tracking online/offline status of people on Facebook, it is possible to get an accurate image of their sleep pattern. Read the blog post:...

CVE-2026-24332

CVE-2026-24332 – Discord Invisible Mode Presence Leak Summary This repository documents CVE-2026-24332, an unpatched privacy‑impacting issue affecting the Discord client and API. The vulnerability allows external clients to determine whether a user marked as Invisible is actually online. Details...

Some cheap smart glasses are a security disaster

Apart from the privacy concerns around smart glasses, researchers have found that some cheap brands come with barely any security at all. ABC Australia reports that researchers from NSB Cyber and Abstract Shield tested two inexpensive pairs, costing A$60 and A$110 around US$42 and US$78, and foun...

Astra Linux – Vulnerability in Thunderbird, Firefox

A race condition could have led to private browsing tabs being opened in regular browsing windows. This could have resulted in a potential privacy breach. This vulnerability has been fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...

Exploit for CVE-2026-24332

CVE-2026-24332 – Discord Invisible Mode Presence Leak Summ...

SUSE CVE-2026-64713

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...

GHSA-JHH7-832H-F8HV WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

PT-2026-61626

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses...

Invoking Encrypted Client Hello privacy leak in crypto/tls

...

BIT-GOLANG-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-49256

CVE-2026-49256 (Discourse) concerns a leakage vulnerability where restricted tag names and tag-group names attached to publicly readable categories could be exposed to anonymous/unauthorized users via category and group endpoints. Affected versions include prior to 2026.6.0, 2026.5.1, 2026.4.2, a...

CVE-2026-42505

A flaw was found in the crypto/tls package in Go. Handshakes utilizing Encrypted Client Hello ECH could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link...

CVE-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-42505

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

GO-2026-5856 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

EUVD-2026-40703

Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-14092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin dat...

Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...