santa

Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...

CVE-2026-33331

CVE-2026-33331 — oRPC OpenAPI Reference Plugin における格納型XSS orpc の OpenAPI ドキュメント生成における格納型XSSの概念実証ラボ 目的 oRPC は OpenAPI 仕様から API ドキュメントページを構築します。v1.13.9 より前のバージョンでは、JSON.stringify を使用して HTML エンコードなしで仕様を直接 タグに出力していました。攻撃者が制御できる info.description などのフィールドは、そのタグを早期に閉じてスクリプトを実行できました。...

flare-learning-hub

FLARE 학습 허브 FLARE 학습 허브는 FLARE 팀의 고품질 리버스 엔지니어링 및 악성코드 분석 교육 콘텐츠를 무료로 배포합니다. FLARE 학습 허브 모듈은 웹에 게시된 Google Docs로 호스팅되며, 각 설명에 링크가 제공됩니다. 이 저장소에는 각 모듈에 대한 실습 및 데모 바이너리, 디스어셈블러 데이터베이스, 스크립트를 포함한 모든 관련 아티팩트가 포함되어 있습니다. 기존 모듈의 개선 및 새 모듈이 지속적으로 게시될 예정입니다. 사용 가능한 모듈 악성코드 분석 집중 과정 Go 리버스 엔지니어링 참고서 Time...

sylvia

iOS AArch64 システムコールアナライザー AArch64 バイナリ内の SVC 命令をスキャンし、X16 レジスタから BSD システムコール番号を解決して、すべての結果をリッチなドッキング可能な UI で表示する IDA Pro スクリプトです。システムコールごとの出現箇所ナビゲーションと、ライブの man ページドキュメント取得に対応しています。 IDA Pro 9.x での iOS / macOS リバースエンジニアリング向けに構築されています。 これを開発した唯一の目的は、改ざん防止対策が施された iOS...

[SECURITY] Fedora 44 Update: python3-docs-3.14.8-1.fc44

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

Fedora 44 : python3-docs / python3.14 (2026-6261b26f4e)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-6261b26f4e advisory. New version of the Python interpreter - Security fix for CVE-2026-19553 - Security fix for CVE-2026-82049 - Security fix for CVE-2026-15310 - Securi...

CVE-2026-54472

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8...

EUVD-2026-93434

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8...

CVE-2026-54472

Dell Container Storage Modules (CSM) , versions prior to 1.18.0 , are vulnerable to a hard-coded credentials flaw in the CSM Authorization module (specifically csm-docs ). An unauthenticated remote attacker can exploit this to forge cryptographically valid administrative tokens, enabling unauthor...

CVE-2026-54472

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8...

[SECURITY] Fedora 45 Update: python3-docs-3.15.0~rc3-1.fc45

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

CVE-2026-54472: Use of Hard-coded Credentials

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8...

Fedora 45 : python3-docs / python3.15 (2026-ab1400e97a)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ab1400e97a advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92936 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92936 Source advisory: OSV:GHSA-X6M4-CHR9-CG97...

CVE-2026-105767

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

EUVD-2026-92780

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

CVE-2026-105767 Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

CVE-2026-105767 Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

CVE-2026-105767 Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

CVE-2026-105767

The integrate-platform-docs composite GitHub Action in Chainguard Academy (edu) is vulnerable to OS Command Injection (CWE-78). The issue arises because the project_id or storage_bucket inputs are interpolated directly into Bash gcloud storage cp commands using ${{ inputs.* }} expressions between...