Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

iron-proxy

iron-proxy Проблема CI-задачи, ИИ-агенты программирования и изолированные контейнеры могут совершать произвольные исходящие запросы. Скомпрометированная зависимость, инъекция в промпт или вредоносный шаг сборки могут выкрасть секреты, связаться с домом или открыть обратную оболочку. У большинства...

s26-m1q-ghostlock-selinux

S26 SM-S942U1 / m1q GhostLock CVE-2026-43499 — uid=0 root + KernelSU 激活达成 针对 Samsung Galaxy S26（SM-S942U1，codename m1q，SoC SM8850 骁龙 8 Elite Gen2， 内核 6.12.30-android16-5-android16-5-pd30ff70，Android 16）的 CVE-2026-43499（GhostLock）提权研究。 ✅ 最终结果：uid=0 root + KernelSU 激活达成 root@kitploit: exploit 后通过...

jsch

Форк JSch-0.1.55 См. оригинальный README Почему стоит использовать эту библиотеку? Как я объяснил в записи в блоге, основные причины таковы: OpenSSH по умолчанию отключил ssh-rsa в релизе 8.8, и вам нужна библиотека, поддерживающая rsa-sha2-256 и rsa-sha2-512. Замена без изменений кода: просто...

CVE-2026-78410

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

DEBIAN-CVE-2026-78410

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

OpenNebula-CVE-2025-56536

OpenNebula-CVE-2025-56536 Exploit Title : OpenNebula 6.10.0.1 - 사용자 정보에 저장된 XSS 사이트 간 스크립팅 Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept :...

CVE-2021-3560-exploit

CVE-2021-3560 — Повышение привилегий в Polkit CVE-2021-3560 — это локальная уязвимость повышения привилегий в Polkit ранее PolicyKit — фреймворке авторизации, используемом в Linux-окружениях рабочего стола. Локальный непривилегированный злоумышленник может использовать состояние гонки в...

CVE-2026-31431

Введение в уязвимость CVE-2026-31431 CVE ID: CVE-2026-31431 Псевдоним: Copy Fail Уровень угрозы: Высокий CVSS v3 балл 7.8 Тип уязвимости: локальное повышение привилегий LPE Затронутый компонент: модуль algifaead ядра Linux криптографический интерфейс AFALG Предварительные условия эксплуатации:...

Nexora

Nexora Nexora — это корпоративная система управления конечными точками и анализа безопасности на основе ИИ, которая отслеживает использование программного обеспечения на машинах, применяет политику классификации рисков и генерирует структурированные отчеты о поведении и безопасности. Она...

CLSA-2026-1788363670 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.25-tuxcare.8...

NLTK: Default ENFORCE=False Disables All pathsec Security Controls

NLTK's pathsec.py security module defaults to ENFORCE=False line 24, which means all 8 security validation functions only emit RuntimeWarning instead of raising exceptions when violations are detected. The pathsec module was introduced as the fix for CVE-2024-39705 arbitrary code execution via...

GHSA-P3M8-78J2-G5P3 NLTK: Default ENFORCE=False Disables All pathsec Security Controls

NLTK's pathsec.py security module defaults to ENFORCE=False line 24, which means all 8 security validation functions only emit RuntimeWarning instead of raising exceptions when violations are detected. The pathsec module was introduced as the fix for CVE-2024-39705 arbitrary code execution via...

behave

Behave! A Still in Development monitoring browser extension for pages acting as bad boys. NB : This is the code repository of the project, if you're looking for the packed extensions: Firefox: https://addons.mozilla.org/en-US/firefox/addon/behave/ Chrome:...

CVE-2026-82293

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...