DRUPAL-CONTRIB-2026-069

The Colorbox module integrates with the Colorbox JavaScript library to display content in an overlay above the page. The module doesn't sufficiently protect against injection of malicious JavaScript under certain scenarios. This vulnerability is mitigated by the fact that an attacker must have a...

security-research

Security Research This project hosts security advisories and...

security-research

Security Research This project hosts security advisories and...

security-research

Security Research This project hosts security advisories and...

security-research

Security Research This project hosts security advisories and...

Metasploit 2025 Annual Wrap-Up

Hard to believe it's that time again, and that Metasploit Framework will see the dawn of another Annual Wrap-Up and a New Year. All of the metrics and modules you see here would in large part not be possible without the dedicated community members who care about the Framework and its mission on a...

awesome-burp-extensions

This is a curated list of Burp Extensions, a collection of user-submitted plugins for the Burp Suite web application security testing tool. The repository is maintained under a CC0 1.0 Universal license, allowing for the permanent relinquishment of copyright and related rights to the works...

Codeshare 安全漏洞

Codeshare is an open source code contribution tool from Codeshare. A security vulnerability exists in Codeshare version v1.0.0 that stems from a risk of information disclosure...

EUVD-2020-2545

Malware in sbrugna...

EUVD-2013-1474

Malware in sbrugna...

EUVD-2020-15156

Malware in sbrugna...

EUVD-2025-18683

Malicious code in bioql PyPI...

EUVD-2025-15902

Malicious code in bioql PyPI...

CVE-2025-59035

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as...

CVE-2025-59035: Improper Neutralization of Input During Web Page Generation

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as...

security-research

Security Research This project hosts security advisories and...

GHSA-7MCQ-F592-PF7V Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs

The crate slice-ring-buffer was developed as a fork of slice-deque to continue maintenance and provide security patches, since the latter has been officially unmaintained RUSTSEC-2020-0158. While slice-ring-buffer has addressed some previously reported memory safety issues inherited from its fork...

SecureFed: a Two-Phase Framework for Detecting Malicious Clients in Federated Learning

Federated Learning FL protects data privacy while providing a decentralized method for training models. However, because of the distributed schema, it is susceptible to adversarial clients that could alter results or sabotage model performance. This study presents SecureFed, a two-phase FL...

EarthOL: a Proof-Of-Human-Contribution Consensus Protocol -- Addressing Fundamental Challenges in Decentralized Value Assessment with Enhanced Verification and Security Mechanisms

This paper introduces EarthOL, a novel consensus protocol that attempts to replace computational waste in blockchain systems with verifiable human contributions within bounded domains. While recognizing the fundamental impossibility of universal value assessment, we propose a domain-restricted...

Stable Channel Update for Desktop

The Stable channel has been updated to 136.0.7103.113/.114 for Windows, Mac and 136.0.7103.113 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept...