DarkSword-PROV2

DarkSword Red Team Framework Framework Python com CLI para en...

CVE-2026-53388: Use After Free

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fusetrymovefolio unlocks the request on entry but does not re-lock it on the success path. This means fusechanabort can end the request and free the fuseioargs eg...

PT-2026-61516

Name of the Vulnerable Software and Affected Versions Meshtastic versions prior to 2.7.21.1370b23 Description An insecure CI/CD workflow configuration in the main matrix.yml workflow allows arbitrary code execution. The workflow is triggered by pull request target and executes code from an...

MSC-2026-6354

SleeperGem RubyGems supply-chain attack: malicious dropper distributed via gitcredentialmanager and dependency injection into Dendreo and fastlane-plugin-runtestsfirebasetestlab. The gem downloads and executes binaries from a remote host git.disroot.org with SSL verification disabled, targeting...

CVE-2026-64046: Improper Input Validation

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link...

Malicious Package

Overview fastlane-plugin-runtestsfirebasetestlab is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid...

Malicious Package

Overview gitcredentialmanager is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid using all malicious...

Malicious Package

Overview Dendreo is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid using all malicious instances of...

@cedarjs/api-server (>=1.0.0-canary.12281, <=9.0.0-canary.1784), @cedarjs/cli (>=1.0.0-canary.12281, <=9.0.0-canary.1784) +41 more potentially affected by CVE-2026-16117 via @fastify/http-proxy (>=11.1.2, <=11.5.0)

@fastify/http-proxy NPM version =11.1.2, =1.0.0-canary.12281, =1.0.0-canary.12281, =6.0.0-canary.2685, =1.0.0-canary.12281, =1.0.0-canary.12281, =4.0.0-canary.13864, =4.0.0-canary.13864, =1.0.0-canary.12281, =3.0.0-alpha-1, =0.0.4, =0.3.0, =0.1.0, =1.0.1, =1.0.14 and more Source cves:...

deep-pentest-skill

Deep Pentest Skill !License: MIThttps://img.shields.io/bad...

share-poc-XRing-O1

CVE-2026-43499 GhostLock – XRing O1 Exploit Research Targ...

How Do You Choose Your AI Component? an Interview Study of Secure AI Integration in Practice

The increasing adoption of Large Language Models LLMs as AI components in modern software systems introduces distinct security risks to the software supply chain. While many considerations and safety mechanisms are in place for components of the traditional software supply chain, the recent rapid...

CVE-2026-48819 Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body, $headers, $path, and $query...

CVE-2026-48819 Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body, $headers, $path, and $query...

CVE-2026-48819 Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body, $headers, $path, and $query...

CVE-2026-48819

CVE-2026-48819 affects the Hey API openapi-ts code generator. Prior to version 0.97.3, the generated template in dist/clients/core/params.ts copies a runtime template into SDKs (params.gen.ts). The function buildClientParams writes unknown keys with slot prefixes (notably $query_) directly into s...

GHSA-RJWR-M7QX-3FJR oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI summary text is embedded into generated TypeScript MCP server source without proper escaping. oapi-codegen has a similar vulnerability in its server...

Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks

In this article 1. Weston on the future of defense 2. Our latest intelligence and response on npm supply chain attacks 3. Follow the research in the Black Hat Briefings 4. Go deeper in Microsoft sessions 5. Visit booth 2144 for research, community, and hands-on defense 6. Plan your week with...

EUVD-2026-45153

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

minder v0.2.0

| | | | | Installation | Documentation | Releases What is Minder? Minder is an open source platform that helps development teams and open source communities build more secure software, and prove to others that what they’ve built is secure. Minder helps project owners proactively manage their...