talos

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Talos is a scalable and secure API key server optimized for low-latency verification, horizontal scaling, and predictable operations. It follows established security best-practices for API keys and issues, verifies, revokes, and...

vault

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

afot

Automation FOrensics Tool The Automation FOrensics Tool AFOT is an automation tool build in Python and used for Windows Forensics in order to combine the following tools: AnalyzePESig http://didierstevens.com/files/software/AnalyzePESigV0002.zip National Software Reference Library reduced set...

keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

Security update for mozilla-nss

This update for mozilla-nss fixes the following issue: remove compromised eMudhra Intermediates CA bsc1286261. Changes for mozilla-nss: update to NSS 3.125.1 bsc1289144: bmo2088196 - backport nssckbi 2.92. bmo2082793 - Don't cache sessions when ECH was rejected. bmo2082792 - Keep DTLS handshake...

CVE-2026-65632

A flaw was found in jose. When verifying Elliptic Curve Digital Signature Algorithm ECDSA signatures, the library does not enforce fixed signature lengths and ignores leading zero bytes. An attacker with a valid token can alter the signature format while keeping it cryptographically valid, causin...

CVE-2026-115557

The eMudha certificate authority issues a set of intermediate CA certificates with weak private keys. A man-in-the-middle attacker could use these weak intermediate CA certificates to issue certificates for arbitrary host names and have them accepted by TLS/SSL clients as valid if those clients...

EUVD-2026-116866

Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepare...

CVE-2026-100235

A time-of-check to time-of-use (TOCTOU) race condition exists in the setACL request handling of Apache ZooKeeper (up to and including version 3.9.6 ). When an ACL is changed, pending changes are not published to the server's outstanding change record. This allows a client to perform operations us...

tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists

A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security TLS implementations fail to properly check Certificate Revocation Lists CRLs when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to...

tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists

A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security TLS implementations fail to properly check Certificate Revocation Lists CRLs when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to...

CVE-2026-106004 DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status...

WordPress DT LMS plugin <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation vulnerability

Unauthenticated Arbitrary Course Completion Revocation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.2...

CVE-2026-106004

The DT LMS WordPress plugin (versions

SUSE SLED15: apache-commons-codec / apache-commons-io / apache-commons-logging / etc (SUSE-SU-2026:5017-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5017-1 advisory. This update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon- logkit,...

Security update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon-logkit, glassfish-jsp, jsch, maven-file-management, opentest4j

This update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon-logkit, glassfish-jsp, jsch, maven-file-management, opentest4j fixes the following issue: CVE-2026-86231: improper check for certificate revocation when processing knownhosts entries...

BootHole

BootHole General information This repository was created to contain relevant helpful scripts and any additional tools or information that can assist others in managing their BootHole vulnerability mitigation plans. Windows Based Platforms We have created a Powershell script that will check the EF...

CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...

BootHoleFix

Boot Hole Fix This script will remediate the BootHole bug identified in CVE-2020-25632 and/or CVE-2021-20233. On July 29, 2020, Microsoft published security advisory 200011 that describes a new vulnerability that's related to Secure Boot. Devices that trust the Microsoft third-party Unified...

CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...