metasploitable3

Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with metasploit. Metasploitable3 is released under a BSD-style license. See COPYING for more details. Quick-start To...

pgaudit

pgAudit 开源 PostgreSQL 审计日志 简介 PostgreSQL 审计扩展（pgAudit）通过标准的 PostgreSQL 日志设施提供详细的会话和/或对象审计日志。 pgAudit 的目标是为 PostgreSQL 用户提供生成审计日志的能力，这些日志通常是满足政府、金融或 ISO 认证要求所必需的。 审计是通常由独立机构对个人或组织账目进行的官方检查。pgAudit 收集的信息应恰当地称为审计跟踪或审计日志。本文档中使用术语“审计日志”。 为什么选择 pgAudit？ 基本的语句日志可以通过标准日志设施中的 logstatement = all...

processhacker-mcp

processhacker mcp 这是一个动态的 MCP 服务器，用于运行时分析和进程操控。它就像是 processhacker，不过是给 AI 智能体使用的。 设置 1. 在 Visual Studio 中打开文件夹（它带有 CMakeLists 文件） 2. 生成全部（Ctrl+Shift+B） 3. 它会生成 ProcessHackerMCP.exe 和 extensions/ 文件夹。 4. 运行 exe。它通过 stdin/stdout 通信。 编辑器集成 你可以配置你的 AI 智能体/编辑器来使用这个服务器。以下是...

vault

Vault 请注意 ：我们非常重视Vault的安全性和用户的信任。如果您认为发现了Vault的安全问题，请通过[email protected]联系我们进行负责任的披露 。 网站：developer.hashicorp.com/vault 公告列表：Google Groups 讨论论坛：Discuss 文档：https://developer.hashicorp.com/vault/docs 教程：https://developer.hashicorp.com/vault/tutorials...

LID

██╗ ██╗██████╗ ██║ ██║██╔══██╗ ██║ ██║██║ ██║ ██║ ██║██║ ██║ ███████╗██║██████╔╝ ╚══════╝╚═╝╚═════╝ Linux Integrity Drift — "Linux está muriendo" — Descubrimiento sistemático de rutas de código del kernel que omiten las garantías de seguridad de LSM La puerta nunca fue derribada. Simplemente la...

CVE-2026-59827

授权的 Metabase CVE-2026-59827 渗透测试工具 一款用于在经批准的渗透测试项目中验证 Metabase 部署中是否存在 CVE-2026-59827 的授权安全评估工具。 该工具旨在通过执行受控的概念验证演示来证明漏洞的存在，同时尽量减少影响，而非尝试破坏性或持久性操作。执行的每个操作都会被记录，以提供适合专业安全评估的审计跟踪。 警告 本项目仅 适用于您拥有或已获得明确书面许可进行测试的系统。未经授权使用可能违反适用法律和组织政策。 功能特性 测试前授权验证 交互式确认或授权令牌支持 多种安全的漏洞演示 自动审计日志 基于 JSON 的渗透测试日志...

vault v2.1.0

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

EUVD-2026-69721

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-84479

WWBN AVideo (version e01e41ecc and earlier) contains an authentication bypass vulnerability where three login-time security controls rely solely on the client-supplied User-Agent header. The isAVideoEncoder() and isAVideoMobileApp() checks match HTTP_USER_AGENT against hardcoded literals ("AVideo...

CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-82863

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring...

EUVD-2026-68451

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring...

CVE-2026-82863

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. An attacker with appropriate access can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring....

CVE-2026-82863 @hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827

Flowintel versions >=3.3.0 contained a validation flaw in the login flow: the code called Email(email) (which only constructs a WTForms validator object) instead of Email()(form, form.email), so malformed attacker-supplied email values bypassed validation. Because CR/LF characters in the email...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the Samba AD LDAP server. The AD DC database audit logging module can access values of LDAP messages freed by a preceding database module, leading to a use-after-free issue. This issue only occurs when certain privileged attributes are modified, such as userAccountControl...

CVE-2025-62307

HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...

CVE-2026-71322

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...

CVE-2026-59675

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...