Security Bulletin:Exposure of Sensitive Information to Unauthorized Actor in Erlang OTP ssh_sftpd Module

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...

Security Bulletin:Erlang OTP ssh (ssh_sftpd) File Discovery: Sensitive Information Exposure

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...

Security Bulletin:Erlang OTP ssh (ssh_sftpd) File Discovery: Sensitive Information Exposure

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...

CVE-2026-106487

A flaw was found in the plugin-kubernetes-backend component of Backstage. In environments configured for catalog cluster discovery, an authenticated catalog contributor can define an unsupported authentication mode on cluster resource entities. This vulnerability allows the backend to query the...

vulnupnp

vulnupnp Scopri i dispositivi uPNP vulnerabili a CVE-2013-0229 / CVE-2013-0230 / CVE-2012-5958 / CVE-2012-5959...

3 lessons from frontier AI vulnerability research

In this article 1. Shift 1. From frontier capability to scale 2. Shift 2. From token consumption to reasoning economics 3. Shift 3. Validation and remediation as a continuous learning loop 4. Transferring security research to help open source projects 5. Open-source vulnerability reporting snapsh...

VulnHunter

VulnHunter !NOTE Un fork mantenuto di VulnHunter di Capital One Apache-2.0 — creato per funzionare su qualsiasi agent harness , non solo Claude Code. Il focus di questo fork: portabilità dell'harness , validazione degli exploit in sandbox containerizzata e PoC a impatto misurato. Vedi Perché le...

Nuclei_Templates

🎯 Nuclei Templates A large personal collection of 50,000+...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

o3_finds_cve-2025-37899

basato su Come ho usato o3 per trovare CVE-2025-37899, una vulnerabilità zero-day remota nell'implementazione SMB del kernel Linux vulnerabilità target vulnerabilità ollama CVE-2024-37032 https://github.com/ollama/ollama/releases/tag/v0.1.34...

CVE-2026-106487

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

CVE-2026-106487 Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

CVE202015808

CVE-2020-15808 Una prova di concetto dell'exploit della vulnerabilità CVE-2020-15808 sulla scheda STM32F4 Discovery Requisiti Versione del firmware precedente alla 1.25.2 Scheda con VCP es. STM32F4 Discovery Toolchain arm-none-eabi Passaggi per riprodurre l'exploit 1. Spostarsi in...

GitMiner3

Autore: UnkL4b Sito: bravul.com Blog: unkl4b.github.io Github: UnkL4b X: @UnkL4b AVVERTENZA +---------------------------------------------------+ | GLI SVILUPPATORI NON SI ASSUMONO ALCUNA | | RESPONSABILITÀ E NON SONO RESPONSABILI PER | | QUALSIASI USO IMPROPRIO O DANNO CAUSATO DA | | QUESTO...

CVE-2026-4889

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

CVE-2026-4889 SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

hello-ReGrade-security

hello-ReGrade-security Una demo pratica di scoperta di zero-day conReGrade. Punterai una normale suite di test su ReGrade, la registrerai contro un piccolo servizio, la riprodurrai contro una seconda copia dello stesso servizio , e userai Claude Code + gli strumenti MCP di ReGrade per far emerger...

HIKRAVEN

HIKRAVEN 🛡️ Piattaforma Avanzata di Valutazione della Sicurezza Hikvision - Edizione Professionale Caratteristiche • Avvio Rapido • Installazione • Utilizzo • Documentazione • Disclaimer ⚠️ AVVISO LEGALE IMPORTANTE ! QUESTO STRUMENTO È SOLO PER TEST DI SICUREZZA AUTORIZZATI ! L'accesso non...

trufflehog v3.98.0

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

onedrive_user_enum

onedriveuserenum v2.10 Gültige OneDrive-Benutzer enumerieren Eine vollständige Erläuterung der Enumerationstechnik und der OneDrive-Enumeration finden Sie im Blog hier: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ Wenn Sie nach der alten Version ohne Datenbank der OneDrive-Enumerati...