CVE-2026-93317

The buildkit software (referenced via the Moby project) is vulnerable to a flaw where an unauthenticated attacker controlling a registry or OCI-layout blob source can provide blob contents that do not match the claimed digest. This allows the resulting snapshot to be cached under the incorrect di...

CVE-2026-93317 Container blob cache can accept unverified content

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

EUVD-2026-92529

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

ClickOnceBlobber

Kit de Inyección AppDomainManager para ClickOnce Armar aplicaciones .NET ClickOnce firmadas para acceso inicial mediante el secuestro de una DLL dependiente a través de inyección AppDomainManager y la carga de un puerto C del Agente ProxyBlob. Incluye un puerto C de ProxyBlob — un proxy SOCKS5 qu...

goblob

Goblob 🫐 Goblob es una herramienta de enumeración ligera y rápida diseñada para ayudar en el descubrimiento de información sensible expuesta públicamente en blobs de Azure, lo cual puede ser útil para diversos fines de investigación como evaluaciones de vulnerabilidades, pruebas de penetración y...

Cobaltstrike_BOFLoader

CobaltstrikeBOFLoader Esta es una adaptación/reimplementación de código abierto del Cobalt Strike BOF Loader tal cual. En su mayor parte, todo se hace como en el Beacon + Teamserver original en Cobalt Strike. Esto incluye deficiencias que se resuelven en otros cargadores COFF de código abierto co...

bcm4360-wpa3

WPA3-SAE + 802.11w en el Broadcom BCM4360 blob wl cerrado Apple/Broadcom nunca le dio al BCM4360 14e4:43a0 WPA3. Su único controlador para Linux es el blob cerrado broadcom-sta wl; brcmfmac no puede manejarlo. Esto añade WPA3-SAE + PMF 802.11w completo a ese blob cerrado — enteramente desde...

BlobHunter

BlobHunter Una herramienta de código abierto para escanear cuentas de almacenamiento de blobs de Azure en busca de blobs de acceso público. BlobHunter es parte de la investigación Hunting Azure Blobs Exposes Millions of Sensitive Files. Descripción general BlobHunter te ayuda a identificar...

etherblob-explorer

EtherBlob Explorer Etherscan.io API를 사용하여 이더리움 네트워크에서 블롭 파일을 검색하고 추출합니다. 소개 EtherBlob Explorer는 연구자, 분석가, CTF 플레이어 또는 이더리움 블록체인 네트워크에서 다양한 종류의 파일이나 의미 있는 사람이 입력한 데이터를 검색하려는 모든 호기심 많은 사람들을 위해 설계된 도구입니다. 사용자가 제공한 블록 ID 범위 또는 UNIX 타임스탬프를 기준으로 5개의 사용 가능한 네트워크MainNet, Görli, Kovan, Rinkeby 및 Ropsten에서...

azure-pentesting-suite

azure-pentesting-suite azpt 🚧 Public beta. azpt is under active development — commands, flags, and output formats may still change between releases. Bug reports and feedback are welcome via GitHub issues. azpt is a Go toolkit for authorized Azure security assessments. It works from two...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload is an HTML Smuggling toolkit for generating HTML pages that embed and reconstruct files using JavaScript. It provides multiple HTML Smuggling methods, payload encoding options, JavaScript variations, and several built-in HTML templates. Features Multiple HTML...

gMSA_Dumper

gMSADumper Reads any gMSA password blobs the user can access and parses the values. gMSADumper.py -h...

Rocky Linux 8 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource (crlsa-2026_24545)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202624545 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource / libyang-devel / etc (crlsa-2026_25051)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625051 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

Rocky Linux 10.2 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource / libyang-devel / etc (crlsa-2026_24758)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202624758 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

CVE-2025-10681

CVE-2025-10681: Hardcoded Azure Blob Storage Account Key Advisory Field| Value ---|--- CVE| CVE-2025-10681 ICSA| ICSA-26-055-03 CVSS 3.1| 8.6 High Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman — Gr0m Published|...

CVE-2026-55726

CVE-2026-55726: Publicly Listable Azure Blob Storage Container device logs Advisory Field| Value ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0|...

CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-blob...

Missing Authorization

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Missing Authorization in the getClientUploadRoute handler for the client-upload path. An attacker can upload files by sending a client upload request t...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...