CVE-2026-81690 verify-usb before 1.4.9 Symlink Directory Traversal Code Execution

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686

openssl_encrypt 1.4.x before 1.4.9 ships an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can set MaxConcurrentOperations to 0/negative (blocking all subsequent op...

EUVD-2026-67042

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

Fake listings can turn trusted platforms into scam springboards

Recently, we found a listing on BuzzFeed from someone pretending to be Malwarebytes Support. It reminded us why we need to be cautious about content on platforms where anyone can create an entry. Based on the phone number, we suspect the people behind this listing are trying to draw callers into ...

pwn2own2020

Compromettere il kernel di macOS tramite Safari concatenando sei vulnerabilità Panoramica Questo repository contiene i dettagli di sfruttamento e tecnici della nostra sottomissione vincente al Pwn2Own 2020 che ha preso di mira Apple Safari con un'escalation dei privilegi del kernel per macOS...

Log4Shell-Honeypot

Log4Shell Honeypot Honeypot dockerizzato potenziato per CVE-2021-44228 con funzionalità complete di sicurezza, monitoraggio e allerta. Funzionalità Rilevamento Potenziato Riconoscimento Completo dei Pattern : Rileva oltre 20 pattern di exploit Log4Shell, inclusi JNDI, LDAP, RMI, DNS e ricerche di...

Findomain v11.0.0-beta.1

Findomain The complete solution for domain recognition. Supports screenshotting, port scanning, importing data from other tools, subdomain monitoring, and more. Be alerted on your findings through services such as Discord, Slack, and Telegram. Multiple API Keys for sources and much more. Chat wit...

CVE-2026-79772

A flaw was found in Nokogiri. This vulnerability occurs because the canonicalize method fails to properly check the return value from an internal XML processing function, returning an empty string on failure instead of an error. A remote attacker could exploit this by providing specially crafted...

CVE-2026-79771

A flaw was found in Nokogiri. Attackers can exploit a memory leak in the XSLT Stylesheet transform method by providing specially crafted input containing null bytes. This can lead to excessive memory consumption and enable a denial of service against long-running processes...

CVE-2026-79769

A flaw was found in Nokogiri. This vulnerability involves a possible invalid memory read in the internal Nodeinitializecopywithargs helper. If application code calls this protected method with an incorrect argument type, such as a non-Node object, it can lead to an out-of-bounds read, causing the...

Security Bulletin: Multiple vulnerabbilities exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager.

Summary IBM Tivoli Network Configuration Manager is affected by multiple security vulnerabilities in IBM SDK, Java Technology Edition. This bulletin addresses the IBM SDK, Java Technology Edition Quarterly Critical Patch Update CPU for Jul 2026, which includes Oracle July 2026 CPU plus four...

copy_fail

Copy Fail — CVE-2026-31431 CVE-2026-31431 Copy Fail é uma vulnerabilidade de escalonamento local de privilégios no módulo algifaead do kernel Linux subsistema AFALG. Uma falha lógica introduzida em agosto de 2017 permite que qualquer usuário local sem privilégios grave 4 bytes controlados no cach...

CVE-2026-46380

A flaw was found in compliance-trestle, a tooling platform for managing compliance as code. The HTTPSFetcher.dofetch method, responsible for remote fetching, passes a user-supplied URL directly to the requests.get function without proper validation. This vulnerability allows a remote attacker to...

cryptovenom

CryptoVenom CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions,...

What the Data Says About AI in Security Operations in 2026

AI is officially mainstream in security operations. According to Prophet Security's State of AI in Security Operations 2026 report produced from ViB’s survey of 250+ cybersecurity pros, 40% of security teams now use AI daily. Another 56% are currently testing it out, and only 4% have no plans to...

RingReaper

RingReaper RingReaper è un agente di post-esplorazione per Linux progettato per chi ha bisogno di operare in modo stealth, riducendo al minimo le possibilità di essere rilevato da soluzioni EDR. L'idea alla base di questo progetto era sfruttare iouring , la nuova interfaccia I/O asincrona del...

Copy-Fail_Detect_and_mitigate_CVE-2026-31431

Copy Fail – CVE-2026-31431-Erkennungs- und Minderungstool Erkennen der Exposition gegenüber CVE-2026-31431 Copy Fail und optionales Anwenden einer Host-Minderung durch Deaktivieren des Kernel-Moduls algifaead auf betroffenen Systemen. Was dieses Repository bietet copyfail-check.sh – prüft den...