CVE-2026-15924

Zephyr's TLS socket layer in subsys/net/lib/sockets/socketstls.c keeps a single process-global array, clientcache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tlssessionsave, tlssessionget, tlssessioncachereset, and the settings...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-24842 DESCRIPTION: node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses...

rsync: rsync: Unauthorized File Access via Symlink Module Root

A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks...

CVE-2026-15924 Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

Zephyr's TLS socket layer in subsys/net/lib/sockets/socketstls.c keeps a single process-global array, clientcache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tlssessionsave, tlssessionget, tlssessioncachereset, and the settings...

CVE-2026-15924 Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

Zephyr's TLS socket layer in subsys/net/lib/sockets/socketstls.c keeps a single process-global array, clientcache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tlssessionsave, tlssessionget, tlssessioncachereset, and the settings...

CVE-2026-15924

Zephyr RTOS TLS socket layer contains a use-after-free and double-free vulnerability in the process-global client_cache array shared across all TLS socket contexts. The root cause is that the per-socket mutex (ctx->lock) provides no mutual exclusion between different sockets concurrently acces...

EUVD-2026-77776

Zephyr's TLS socket layer in subsys/net/lib/sockets/socketstls.c keeps a single process-global array, clientcache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tlssessionsave, tlssessionget, tlssessioncachereset, and the settings...

hate_crack

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / Installation Installing from source is the only supported path. hatecrack is not distributed on PyPI: pip install hate-crack resolves to a 0.0.0 placeholder that...

hate_crack

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / 安装 从源码安装是唯一受支持的途径。hatecrack 不 在 PyPI 上分发：pip install hate-crack 会解析到一个 0.0.0 占位包，该包故意安装失败并指向此处。保留该名称只是为了阻止他人以此名义发布仿冒包——参见 packaging/pypi-placeholder/。 1. 安装...

mitmproxy2swagger

mitmproxy2swagger https://user-images.githubusercontent.com/5400940/168086818-c48f60ab-3f95-42eb-b435-c8b1a6326b81.mp4 A tool for automatically converting mitmproxy captures to OpenAPI 3.0 specifications. This means that you can automatically reverse-engineer REST APIs by just running the apps an...

jadx-ai-mcp

JADX-AI-MCP Part of Zin MCP Suite ⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly. ⭐ Contributors Thanks to these wonderful people for thei...

SQLRecon

SQLRecon SQLRecon 是一款专为攻击性侦察和后渗透阶段设计的 Microsoft SQL Server 工具集。如需详细了解每个技术的使用方法，请参考维基。 您可以从 releases 页面下载 SQLRecon 的副本。也可以自行编译解决方案——克隆仓库、双击解决方案文件并生成即可，过程简单直接。 针对防御者，我们还提供了预防、检测与缓解指南。 欢迎阅读我在 IBM Security Intelligence 网站上的博文。如果您更喜欢视频，可以观看我在 Black Hat 的演讲。 枚举模块 枚举模块不需要提供身份验证提供者。这些模块必须传递到枚举模块标志（/e:,...

edk2

============== Proyecto EDK II Un entorno de desarrollo de firmware moderno, rico en funciones y multiplataforma para las especificaciones UEFI y PI de www.uefi.org. .. image::...

herpaderping

Process Herpaderping Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself. Summary Generally, a security product takes action on process...

jadx

JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...

jadx

JADX jadx - Dex 到 Java 反编译器 命令行和图形界面工具，用于从 Android Dex 和 Apk 文件生成 Java 源代码 !WARNING 请注意，在大多数情况下 jadx 无法反编译全部 100% 的代码，因此会出现错误。 请查看故障排除指南 了解解决方法。 主要功能： 将 Dalvik 字节码反编译为 Java 代码（来自 APK、dex、aar、aab 和 zip 文件） 解码 AndroidManifest.xml 和来自 resources.arsc 的其他资源 包含反混淆器 jadx-gui 功能： 查看高亮语法的反编译代码 跳转到声明 查找用法...

CVE-2026-55846

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...

laravel-threat-detection

Laravel Threat Detection Security monitoring and attack logging for Laravel. Detect and log SQL injection, XSS, RCE, directory traversal, bot scanners and/wp-admin-style recon probes — every hostile request recorded to your database with full application context. It's an IDS, not a WAF: it never...

naabu

Features • Installation • Usage • Running naabu • Config • NMAP integration • CDN/WAF Exclusion • Discord Naabu is a port scanning tool written in Go that allows you to enumerate valid ports for hosts in a fast and reliable manner. It is a really simple tool that does fast SYN/CONNECT/UDP scans o...

truegaze

truegaze A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only...