lsarelayx

lsarelayx Introduction lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB. Since lsarelayx hooks into existing application authentication flows, the...

usbsnoop

usbsnoop — live USB transfer sniffer from two fentry hooks A real-time, colorized feed of USB traffic system-wide — built on the two universal URB chokepoints every host-controller driver funnels through, so it works on xHCI/EHCI/OHCI/dwc alike with no per-controller tracepoints and no usbmon...

zen-desktop

Zen: Your Comprehensive Ad-Blocker and Privacy Guard There is, simply, no way, to ignore privacy. Because a citizenry’s freedoms are interdependent, to surrender your own privacy is really to surrender everyone’s. Edward Snowden, Permanent Record Website • Mastodon • Bluesky • Discord •...

Linux Distros Unpatched Vulnerability : CVE-2026-97024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host syste...

CVE-2026-96281 Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious...

CVE-2026-92601: Missing Authorization

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide...

CVE-2026-83342

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and...

EUVD-2026-79695

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and...

CVE-2026-83343

CVE-2026-83343 affects Oracle Utilities Network Management System (component: System Wide) in versions 2.5.0.2.0–2.5.0.2.13, 2.6.0.1.0–2.6.0.12B, 2.6.0.2.0–2.6.0.2.10A, and 25.12.0.0.0–25.12.0.0.3 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain un...

CVE-2026-83342

Oracle Utilities Network Management System (component: System Wide ) is affected by an easily exploitable local vulnerability. A low-privileged attacker with logon to the hosting infrastructure can compromise the system, resulting in full takeover with high impact to confidentiality, integrity, a...

PT-2026-92865

Name of the Vulnerable Software and Affected Versions Oracle Utilities Network Management System versions 2.5.0.2.0 through 2.5.0.2.13 Oracle Utilities Network Management System versions 2.6.0.1.0 through 2.6.0.12B Oracle Utilities Network Management System versions 2.6.0.2.0 through 2.6.0.2.10A...

CVE-2026-83343: Missing Authentication for Critical Function

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. Easily exploitable vulnerability...

oxenstored: Unbounded accumulation of watches

ISSUE DESCRIPTION Oxenstored maintains two datastructures about watches; one global trie, and one hashtable tracked per domain. When a xenbus reconnect is requested, watches are not cleared out of the global trie. IMPACT A guest can cause unbounded memory usage in oxenstored. This can lead to a...

zen-desktop v0.25.1

Zen: Your Comprehensive Ad-Blocker and Privacy Guard There is, simply, no way, to ignore privacy. Because a citizenry’s freedoms are interdependent, to surrender your own privacy is really to surrender everyone’s. Edward Snowden, Permanent Record Website • Mastodon • Bluesky • Discord •...

SUSE CVE-2026-47125

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/id/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin...

CVE-2026-62427

The Xen hypervisor is vulnerable to a flaw where platform-op locks can be opened to abuse. Specifically, while the control domain or a Xenstore domain uses system-wide locks for operations that may not be executed in parallel, the acquisition method lacks fairness. Furthermore, when XSM/Flask is ...

ublockdnsclient v0.3.0

uBlockDNS Client uBlockDNS Client is an independent project and is not affiliated with, endorsed by, or related to uBlock Origin or its maintainer. uBlockDNS Client brings DNS-level ad and tracker blocking to your entire device. It uses community-maintained filter lists such as EasyList and...

ublockdnsclient v0.2.1

uBlockDNS Client uBlockDNS Client is an independent project and is not affiliated with, endorsed by, or related to uBlock Origin or its maintainer. uBlockDNS Client brings DNS-level ad and tracker blocking to your entire device. It uses community-maintained filter lists such as EasyList and...

EUVD-2026-24963

chmod: --preserve-root bypassed by any path that resolves to root e.g. /../...

Malicious code in test-pkg-pnpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo...