Security Bulletin:Exposure of Sensitive Information to Unauthorized Actor in Erlang OTP ssh_sftpd Module

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...

Security Bulletin:Erlang OTP ssh (ssh_sftpd) File Discovery: Sensitive Information Exposure

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...

Security Bulletin:Erlang OTP ssh (ssh_sftpd) File Discovery: Sensitive Information Exposure

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...

CVE-2026-106487

A flaw was found in the plugin-kubernetes-backend component of Backstage. In environments configured for catalog cluster discovery, an authenticated catalog contributor can define an unsupported authentication mode on cluster resource entities. This vulnerability allows the backend to query the...

vulnupnp

vulnupnp Обнаружение устройств uPNP, уязвимых к CVE-2013-0229 / CVE-2013-0230 / CVE-2012-5958 / CVE-2012-5959...

3 lessons from frontier AI vulnerability research

In this article 1. Shift 1. From frontier capability to scale 2. Shift 2. From token consumption to reasoning economics 3. Shift 3. Validation and remediation as a continuous learning loop 4. Transferring security research to help open source projects 5. Open-source vulnerability reporting snapsh...

VulnHunter

VulnHunter !NOTE Поддерживаемый форк Capital One's VulnHunter Apache-2.0 — создан для работы на любой агентной среде , а не только в Claude Code. Фокус этого форка: переносимость между средами , песочница контейнеризованная для валидации эксплойтов и PoC с измеряемым воздействием. См. Зачем эти...

Nuclei_Templates

🎯 Nuclei Templates A large personal collection of 50,000+...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

o3_finds_cve-2025-37899

на основе Как я использовал o3 для поиска CVE-2025-37899, удалённой zero-day уязвимости в реализации SMB ядра Linux целевая уязвимость ollama vuln CVE-2024-37032 https://github.com/ollama/ollama/releases/tag/v0.1.34 https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34 commit: 2a21363 с...

CVE-2026-106487

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

CVE-2026-106487 Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

CVE202015808

CVE-2020-15808 Доказательство концепции эксплуатации уязвимости CVE-2020-15808 на плате STM32F4 Discovery Требования Версия прошивки старше 1.25.2 Плата с VCP например, STM32F4 Discovery arm-none-eabi toolchain Шаги для воспроизведения эксплойта 1. Перейдите в папку VulnerableFirmwareF4 и...

GitMiner3

Autor: UnkL4b Сайт: bravul.com Блог: unkl4b.github.io Github: UnkL4b X: @UnkL4b ПРЕДУПРЕЖДЕНИЕ +---------------------------------------------------+ | РАЗРАБОТЧИКИ НЕ НЕСУТ НИКАКОЙ ОТВЕТСТВЕННОСТИ И | | НЕ ОТВЕЧАЮТ ЗА ЛЮБОЕ НЕПРАВИЛЬНОЕ ИСПОЛЬЗОВАНИЕ | | ИЛИ УЩЕРБ, ПРИЧИНЁННЫЙ ЭТОЙ ПРОГРАММОЙ |...

CVE-2026-4889

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

CVE-2026-4889 SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

hello-ReGrade-security

hello-ReGrade-security Практическая демонстрация обнаружения zero-day уязвимостей с помощьюReGrade. Вы направите обычный набор тестов на ReGrade, запишете его работу против крошечного сервиса, воспроизведёте её на второй копии того же сервиса и с помощью Claude Code + ReGrade MCP-инструментов...

HIKRAVEN

HIKRAVEN 🛡️ Платформа расширенной оценки безопасности Hikvision — профессиональная версия Возможности • Быстрый старт • Установка • Использование • Документация • Отказ от ответственности ⚠️ ВАЖНОЕ ЮРИДИЧЕСКОЕ УВЕДОМЛЕНИЕ ! ЭТОТ ИНСТРУМЕНТ ПРЕДНАЗНАЧЕН ТОЛЬКО ДЛЯ АВТОРИЗОВАННОГО ТЕСТИРОВАНИЯ...

trufflehog v3.98.0

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

onedrive_user_enum

onedriveuserenum v2.10 유효한 OneDrive 사용자를 열거합니다. 열거 기법과 OneDrive enum에 대한 전체 내용은 다음 블로그를 확인하세요: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ 이전의 비데이터베이스 버전의 OneDrive Enum을 찾고 있다면 여기에서 찾을 수 있습니다: https://github.com/nyxgeek/simplescanners 2.10의 새로운 기능: 원격 MySQL DB 로깅 옵션 -- 원격 데이터베이스에 로...