SSHPry2.0

SSHPry2.0 Это второй релиз инструмента SSHPry, с добавлением множества функций. Управление TTY цели Встроенный кейлоггер Фишинг на уровне консоли Запись и воспроизведение предыдущих сессий Демо: https://youtu.be/2gfnBvu1u34 Пост в блоге:...

agensic

Знайте, что выполнялось, где, когда и кем Недостающий уровень наблюдаемости для терминальных рабочих процессов на базе ИИ Signed Provenance Tracked Sessions Git Time Travel Replayable Sessions IDE style Tab Autocomplete Agensic модернизирует ваш существующий терминальный рабочий процесс для эпохи...

JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

CVE-2026-41940-Exploit-PoC

CVE-2026-41940 익스플로잇 PoC 1. 익스플로잇 스크립트를 실행하고 대상을 지정합니다 root@kitploit: python3 exploit.py --target https://example.com:2087/ 2. 세션을 캡처하고 Burp Suite에서 재생합니다 스크립트가 생성한 whostmgrsession 값을 복사합니다 Burp Suite의 브라우저에서 대상 URL을 엽니다 각 요청의 whostmgrsession 값을 캡처한 값으로 교체합니다 요청을 전달합니다 3. 결과 성공적으로 익스플로잇되면 인증이...

CVE-2026-79696

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

EUVD-2026-74768

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

CVE-2026-79696

Google Cloud Agent Development Kit (ADK) for Python (versions 2.0.0 through 2.6.0) contains a code injection vulnerability in the adk web component caused by an incomplete standard library denylist . In environments where pytest is installed—on Python (OSS), Cloud Run, and GKE—an unauthenticated ...

PT-2026-88902

🚨 Google disclosed a CVSS 10.0 vulnerability in ADK for Python today. The fixed version shipped 27 days ago. CVE-2026-79696 affects specific conditions: 🔹 ADK for Python 2.0.0 through 2.6.0 🔹 The adk web development interface 🔹 Environments where pytest is installed 🔹 Network access to the affect...

CVE-2026-75034 Rancher: SAML Assertion Replay

A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a...

Malicious code in amplitude-session-replay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb71ca2dc9e74e42a64b1533ecb98ea1cad26e283b0c3d3ba0f4e7c760fac713 package.json declares a dependency whose key is the package's own name amplitude-session-replay and whose value is a plain HTTPS URL,...

CVE-2025-61479

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepts replayed application-layer payloads injected into an active TCP session...

CVE-2025-61479

Vanderbilt Industries Acre Security SPC5300.000 Main Board version 3.14.1 is affected by a denial-of-service vulnerability. The root cause is that SPC Connect Pro software accepts replayed application-layer payloads injected into an active TCP session, allowing a physically proximate attacker to ...

CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormIn...

OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning

A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers'...

CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

CVE-2026-66883

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

CVE-2026-14465 Session Fixation in Bilin Software's HUMANIST Digital Human Resources

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-15614

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15614

CVE-2026-15614 affects Logto: IdP-initiated SAML sessions are not handled atomically, as session lookup may complete before deletion. This can allow the same session identifier to pass validation twice, enabling replay/dual sign-ins within the session’s window. The description and connected refer...