fwknop

fwknop - 单包授权 Single Packet Authorization 简介 fwknop 实现了一种称为单包授权 SPA 的授权方案，用于强大的服务隐藏。SPA 只要求一个数据包，该数据包经过加密、不可重放，并通过 HMAC 进行身份验证，以便向隐藏在默认丢弃过滤规则的防火墙后面的服务传达所需的访问权限。SPA 的主要应用是使用防火墙丢弃所有尝试连接到 SSH 等服务的行为，从而使利用漏洞（包括 0-day 和未打补丁的代码）更加困难。由于没有开放端口，任何通过 SPA 隐藏的服务自然无法被 Nmap 扫描到。fwknop 项目支持四种不同的防火墙：Linux 上的...

DNSnitch

DNSnitch Aviso legal Lo uso para mí mismo, pero está aquí por si alguien lo necesita. ¡No dudes en abrir un issue si encuentras errores! El Cortafuegos DNS Interactivo de Terminal DNSnitch es un servidor DNS local, centrado en la privacidad, que te otorga control total sobre tu tráfico de red. A...

agent

Bomfather Agent Bomfather Agent es un agente basado en eBPF que se ejecuta en el espacio del kernel para bloquear acciones según una política. Creamos este agente para resolver los problemas que teníamos con las soluciones existentes. 1. Eran demasiado complejas de configurar y usar. 2. Eran...

BlockGuard

🛡️ BlockGuard — 基于进程的文件访问安全代理 BlockGuard 是一款 Windows 数据丢失防护 DLP 代理，可在进程级别拦截并控制文件访问。它确保只有授权进程 （通过可执行文件路径、加密哈希、验证码签名和完整性级别识别）才能读取受保护文件。所有其他进程默认通过 NTFS ACL 在操作系统内核级别被拒绝访问 。 📑 目录 功能特性 架构 UI 管理界面 先决条件 快速开始 配置 运行代理 验证运行效果 项目结构 工作原理 故障排除 安全考量 贡献 ✨ 功能特性 功能特性| 描述 ---|--- 默认拒绝 ACL| 代理启动时锁定受保护文件——仅保留 SYSTEM...

iron-proxy

iron-proxy The problem CI jobs, AI coding agents, and sandboxed containers can make arbitrary outbound requests. A compromised dependency, a prompt injection, or a malicious build step can exfiltrate secrets, phone home, or open a reverse shell. Most teams have zero visibility into what's leaving...

opennhp v1.0.1

OpenNHP: Open Source Zero Trust Security Toolkit OpenNHP is a lightweight, cryptography-powered, open-source toolkit implementing Zero Trust security for infrastructure, applications, and data. It is the reference implementation of the Cloud Security Alliance CSA Network-infrastructure Hiding...

JLSEC-2026-794 Hugo: XSS via text/html content files

Commit: e41a06447d — Disallow HTML content by default Affected versions: all Hugo versions prior to v0.162.0. Fixed in: v0.162.0. Severity: Low to Medium, depending on threat model. Not an issue if you fully trust every file under /content and every content adapter you load. Description. Hugo...

EUVD-2026-43696

On Xtensa SoCs built with CONFIGXTENSAMPU and CONFIGUSERSPACE, archbuffervalidate in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 access permitted a...

Unrestricted file upload in kiwi TCMS

ImpactKiwi TCMS allows users to upload attachments to test plans, test cases, etc. In earlier versions there is no control over what kinds of files can be uploaded. Thus a malicious actor may upload an .exe file or a file containing embedded JavaScript and trick others into clicking on these file...

CVE-2026-42596

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as...

CVE-2026-42596 Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as...

PT-2026-39661

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.32.0 Description Gotenberg is a Docker-powered stateless API for PDF files. The Chromium URL-to-PDF endpoint '/forms/chromium/convert/url' lacks default protection against Server-Side Request Forgery SSRF for HTTP...

GHSA-4VMC-GM8V-M35H Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Summary The default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://::ffff:127.0.0.1:... and reach loopback or private HTTP services that the...

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Summary The default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://::ffff:127.0.0.1:... and reach loopback or private HTTP services that the...

PT-2026-38386

Name of the Vulnerable Software and Affected Versions Gotenberg versions prior to 8.31.0 Description An unauthenticated attacker can bypass the default deny-lists used by the downloadFrom and webhook features. The issue occurs because the filtering logic uses case-sensitive regular expressions th...

CVE-2026-41081 Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication the default configuration, the...

EUVD-2026-15413

A use-after-return vulnerability exists in the named server when handling DNS queries signed with SIG0. Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly mismatch an IP address. In a default-allow ACL denying only specific IP addresses, this may lead to...

CVE-2026-3591

A use-after-return vulnerability exists in the named server when handling DNS queries signed with SIG0. Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly mismatch an IP address. In a default-allow ACL denying only specific IP addresses, this may lead to...

UBUNTU-CVE-2026-3591

A use-after-return vulnerability exists in the named server when handling DNS queries signed with SIG0. Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly mismatch an IP address. In a default-allow ACL denying only specific IP addresses, this may lead to...

CVE-2025-13357

Vault’s Terraform Provider has a vulnerability (CVE-2025-13357) where the default deny_null_bind parameter for the LDAP authentication method was set to false, potentially allowing anonymous/unauthenticated binds and authentication bypass. Concrete details across sources indicate this affects the...