tailsnitch

Tailsnitch Tailscale 配置的安全审计工具。Tailsnitch 会扫描您的 tailnet，检查 57 种错误配置、过度宽松的访问控制以及违反安全最佳实践的问题。 快速开始 1. 设置您的 Tailscale API 凭据 export TSAPIKEY="tskey-api-..." 2. 运行审计 tailsnitch 3. 仅查看高严重性发现 tailsnitch --severity high 4. 修复一些问题 交互式 yolo 模式 tailsnitch --fix 安装 下载预编译二进制文件 从 GitHub Releases 下载最新版本。 macOS...

CVE-2019-7238

CVE-2019-7238 Nexus Repository Manager 3 无需认证的远程代码执行漏洞，影响版本 3.15.0，由 Rico 腾讯安全云鼎实验室和 @voidfyoo 发现 详细分析（英文）： https://chybeta.github.io/2019/02/18/Nexus-Repository-Manager-3-RCE-%E5%88%86%E6%9E%90-%E3%80%90CVE-2019-7238%E3%80%91/ 详细分析（非英文）： https://xz.aliyun.com/t/4136...

EUVD-2026-96202

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108...

CVE-2026-8374

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...

CVE-2026-8374

The SwitchBot Door Lock Series is affected by a vulnerability involving the misuse and misconfiguration of cryptographic algorithms during Bluetooth communication. An attacker can exploit a manipulated communication protocol to bypass the electronic lock and gain access to security controls. The ...

EUVD-2026-95745

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...

gitoops

GitOops! 😱 すべての道はクラウドへ通じる GitOopsは、攻撃者と防御者がGitHub Organization内の横移動や権限昇格パスを特定するためのツールで、CI/CDパイプラインやGitHubのアクセス制御を悪用します。 このツールは、GitHub OrganizationとそのCI/CDジョブおよび環境変数との関係をマッピングすることで動作します。Bolt互換のグラフデータベースをバックエンドとして使用するため、openCypherを使って攻撃パスをクエリできます。 MATCH p=:Userlogin:"alice"-..5-v:EnvironmentVariabl...

PT-2026-108891

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - 对 AJAX 调用的不当访问控制（Subscriber+） 描述： 该插件中的部分 AJAX 调用未正确检查权限和 CSRF 令牌，从而导致任意文章读取、订阅者列表导出以及插件停用等问题。 reference: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ef067b-e4b4-4174-b6ff-ec94a7afd55d?source=api-prod classification:...

CVE-2026-90711

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...

Apache Tomcat JK Connect <=1.2.44 - Manager Access

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

Ubuntu 22.04 LTS : Go vulnerability (USN-8883-1)

The remote Ubuntu 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8883-1 advisory. It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly...

CVE-2026-102407

A flaw was found in Elasticsearch. An authenticated user with permissions for at least one resource can exploit improper access controls in the Modify Data Streams application programming interface API to alter unauthorized data streams. Successful exploitation allows the user to inject data or...

CVE-2026-106326

A confused deputy flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511745101...

USN-8883-1 golang-1.18, golang-1.21, golang-1.24 vulnerability

It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges...

USN-8883-1: Go vulnerability

It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

Aviso de seguridad: los controles de acceso insuficientes permiten la eliminación no autorizada de salas Let's Chat Identificador CVE asignado: CVE-2026-66751 Resumen DELETE /rooms/:room no realiza ninguna comprobación de autorización más allá de requerir un inicio de sesión. Cualquier cuenta pue...

Aembit Extends Access Controls to Personal AI Agents

Silver Springs, United States / Maryland, 6th October 2026, CyberNewswire...

CVE-2026-105062: Missing Authorization

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...