CVE-2021-28663

CVE-2021-28663 A basic PoC leak for CVE-2021-28663 Internal of the Android kernel backdoor vulnerability This is a basic PoC for CVE-2021-28663. A design flaw in Mali GPU Android Kernel Driver. 1. Create a GPUVA and also mmap to it so we can get virtual addr for phys pages. 2. Create an alias for...

libqcow

libqcow is a library to access the QEMU Copy-On-Write QCOW image file format. Project information: Status: alpha Licence: LGPL-3.0-or-later Read-only supported QCOW formats: version 1 version 2 version 3 Supported QCOW format features: zlib DEFLATE compression AES-CBC 128-bit encryption backing...

libfsntfs

libfsntfs is a library to access the New Technology File System NTFS format. Project information: Status: experimental Licence: LGPL-3.0-or-later Read-only supported NTFS formats: NTFS version 3.0 NTFS version 3.1 Supported NTFS format features: LZNT1 compression Windows Overlay Filter WOF...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

cynative

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Built-in agents · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning throu...

CVE-2026-86698

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...

EUVD-2026-84539

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...

CVE-2026-86698 Refresh tokens accepted as private repository credentials at the CDN

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...

CVE-2026-54076 ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

EUVD-2026-78586

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-43785

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read...

EUVD-2026-77521

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

CVE-2026-82434

Apache Storm Nimbus and the submission client disclose the storm.zookeeper.topology.auth.payload credential to callers holding only read-only topology permissions, and also write it to logs at INFO (client) and DEBUG (SASL handlers). The credential is not read-only : it carries write-capable ACLs...

CVE-2026-82434 Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hiding the first-in-list PCIe extended capabilities There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability i.e., a capability with an ID greater than...

Astra Linux – Vulnerability in Zabbix

JavaScript preprocessing can be exploited by attackers to gain access to the file system read-only access on behalf of the user “zabbix” on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data...

PT-2026-91499

Name of the Vulnerable Software and Affected Versions iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 tvOS versions prior to 27 visionOS versions prior to 27 Description A permissio...

PT-2026-91237

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id an...

cynative v1.11.3

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Built-in agents · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning throu...