EUVD-2026-96017

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...

CVE-2026-108267

The Privasys Go programming language fork, which provides RA-TLS support for crypto/tls , is vulnerable in versions prior to privasys-v0.5.1-go1.26.5 . In challenge-mode RA-TLS, certificates failed to bind quote ReportData to the active TLS session, binding it only to the certificate public key a...

CVE-2026-108267 Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...

CVE-2018-16341

CVE-2018-16341 Обход аутентификации Nuxeo и удалённое выполнение кода версии 10.3 с помощью SSTI - CVE-2018-16341 Подробный анализ не на английском : https://www.freebuf.com/vuls/193000.html https://blog.riskivy.com/nuxeo-rce-analysis-cve-2018-16341/ Уведомление о безопасности :...

GoBfuscator

🛡️ GoBfuscator - 고급 Go 코드 난독화 도구 🔍 개요 GoBfuscator는 Go Golang 소스 코드를 위해 특별히 설계된 전문가급 난독화 도구입니다. 100% 런타임 기능을 유지하면서 리버스 엔지니어링을 어렵게 만들기 위해 여러 계층의 보호 기능을 제공합니다. 주요 기능: ✨ 런타임 복호화를 지원하는 AES-256 암호화 문자열 🔀 포괄적인 식별자 이름 변경 함수, 변수, 타입 🧹 코드 정리 및 주석 제거 🛡️ 일반적인 리버스 엔지니어링 기법에 대한 보호 ⚡ 초기 복호화 이후 런타임 성능 오버헤드 제로 🚀 빠른...

EUVD-2026-95997

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2026-108266

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2026-108266

The Privasys rustls library, a fork of rustls providing RA-TLS challenge and channel-binding support, is vulnerable in versions prior to privasys-v0.8.1 . The root cause is that RA-TLS challenge certificates emitted by the library bound quote ReportData to the certificate public key and client no...

CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2021-22192

CVE-2021-22192 CVE-2021-22192 실습 환경: 인증되지 않은 사용자 RCE 취약점 0x10 실습 환경 0x20 디렉터리 구조 CVE-2021-22192 ├── README.md ............... 이 README 설명 ├── imgs .................... README 설명 보조 이미지 ├── gitlab .................. Gitlab 컨테이너의 마운트 디렉터리 │ ├── Dockerfile .......... Gitlab의 Docker 빌드 파일 │ ├── confi...

GHSA-M687-P538-R5HP Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Summary Vikunja ships with cors.origins defaulting to http://127.0.0.1: and http://localhost:, and sends Access-Control-Allow-Credentials: true, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses. The mandatory...

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Summary Vikunja ships with cors.origins defaulting to http://127.0.0.1: and http://localhost:, and sends Access-Control-Allow-Credentials: true, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses. The mandatory...

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...

GHSA-FMMF-XQ98-G327 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

Summary A collaborator removed from a project keeps a live, automatic feed of that project's contents, because nothing on any revocation path deletes the webhook they created while they had access. Vikunja already has a revocation-cleanup routine that deletes other derived rows for exactly this...

GHSA-HJX8-QV73-F7CM Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

Summary A collaborator removed from a project keeps a live, automatic feed of that project's contents, because nothing on any revocation path deletes the webhook they created while they had access. Vikunja already has a revocation-cleanup routine that deletes other derived rows for exactly this...

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the...

GHSA-FPRF-R6RV-XG99 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the...

GHSA-J3HG-9RP3-5HW9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...