CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...

EUVD-2026-77442

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...

CVE-2026-90955 MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...

CVE-2026-90955

MISP versions ≤ 2.5.45 contain a defect in the interactive CLI shell's audit logging. The legacy SysLogLogable behavior stored the impersonated user identity in behavior-instance state, which could be overwritten when another model lazily attached the shared behavior . As a result, subsequent CLI...

CVE-2026-90955 MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Audit: Improved robustness of audit queue handling If the audit daemon becomes stuck in a stopped state, the kauditdthread function in the kernel might get blocked while attempting to send audit records to the audit daemon in the...

DiffCatcher

Support Development If this project helps your work, support ongoing maintenance and new features. ETH Donation Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scan the QR code or copy the wallet address above. A Rust CLI tool that recursively discovers Git repositories, captures state changes,...

rsc-security-auditor

🛡️ RSC セキュリティ監査ツール Next.js および React Server Components スタックにおける深刻なセキュリティ脆弱性（CVE-2025-66478、CVE-2025-55184）を検出します。 🚨 緊急: 2025年12月の最近の開示により、React Server Components に深刻な DoS および RCE 脆弱性が明らかになりました。このツールは、package.json を即座に監査するのに役立ちます。 ⚡ 機能 🔒 プライバシー最優先: 100% クライアントサイド。あなたの package.json データはブラウザから 決して...

PT-2026-91194

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache...

cso-vibecheck

cso-vibecheck root@kitploit: ██████╗███████╗ ██████╗ ██╗ ██╗██╗██████╗ ███████╗ ██╔════╝██╔════╝██╔═══██╗ ██║ ██║██║██╔══██╗██╔════╝ ██║ ███████╗██║ ██║ ██║ ██║██║██████╔╝█████╗ ██║ ╚════██║██║ ██║ ╚██╗ ██╔╝██║██╔══██╗██╔══╝ ╚██████╗███████║╚██████╔╝ ╚████╔╝ ██║██████╔╝███████╗ ╚═════╝╚══════╝...

nullorigin

NullOrigin 🛡️ Universal AI Provenance & Watermark Sanitization Middleware Research artifact — for watermarking robustness evaluation only. 🔬 Research use only NullOrigin is a research artifact. It is published to support academic and independent study of watermarking robustness, and for no other...

puppet-ssh-hardening

Puppet SSH hardening Description This Puppet module provides secure ssh-client and ssh-server configurations. Requirements Puppet Puppet modules: saz/ssh = 2.3.6, puppetlabs/stdlib = 4.2.0 Parameters ipv6enabled = false - true if IPv6 is needed...

CVE-2026-29812

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...

CVE-2025-57529

CPAS-bug CPAS audit management information system has SQL injection vulnerability Beijing YouDataSum Technology Co., Ltd. domain: http://youdatasum.com info root@kitploit: CVE-ID: CVE-2025-57529 affected version: findArchiveReportByDah@RequestParamvalue = "pageNum", defaultValue = "0" int pageNum...

CIFSwitch-Checker-CVE-2026-46243

CIFSwitch Checker - CVE-2026-46243 适用于 Linux 的检查器，用于识别可能受到 CIFSwitch 漏洞 CVE-2026-46243 影响的配置。 该工具不利用漏洞，也不修改系统。主要目标是帮助识别潜在受影响的计算机并验证缓解措施。 该工具对以下内容执行被动检查： cifs-utils cifs.upcall request-key CIFS/SMB 用户命名空间 常见缓解措施 技术参考 原始漏洞和用于开发此检查器的概念验证 PoC 可在以下仓库中找到： https://github.com/manizada/CIFSwitch 安装与使用 克隆仓...

MDE-AuditCheck

MDE-AuditCheck Makes sure all audit settings MDE relies on are properly set in the GPO The script relies on the Remote Server Administration Tools RSAT...

CVE-2026-29812

CyberPanel versions prior to 2.4.4 lack logging for actions that could potentially manipulate the child domains list , reducing auditability of changes to that list. The vulnerability is scored CVSS 4.3 (Medium) with low integrity impact and no confidentiality or availability impact, requiring on...

CVE-2026-29812

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...

CVE-2026-29812

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...

CVE-2025-29471

Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin ▶️ PoC Demo Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...