encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

Important: Red Hat Security Advisory: grafana-pcp security update

An update for grafana-pcp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

SonicWall NSM On-Prem Affected By Multiple Vulnerabilities

1 CVE-2026-78327 - Authenticated Command Injection Vulnerability An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin...

CESS

CESS — 암호학적으로 강화된 샤미르 비밀 이것은 AI 헛소리인가요, 저질인가요? 암호학자나 진지한 구현자가 CESS를 검토할 때는 일반적으로 산문을 읽기 전에 vectors/와 testdata/를 엽니다. 테스트 스위트는 작업 증명입니다: 이야기만으로는 대체할 수 없는 도메인 지식을 인코딩합니다. 그렇다고 해서 다른 사람들에게 요점을 숨길 이유는 없습니다. 조달을 위해 프로젝트를 평가하거나, 기여 여부를 결정하거나, 정책을 작성하거나, 암호화 테스트 방법론에 대한 깊은 교육 없이 코드를 출시하는 사람들도 구체적인 증거를 가...

IAGA-Sentinel v2.1.0

IAGA Sentinel The EU AI Act conformity evidence layer for AI agents. Cryptographically signed, replay-verifiable evidence of every action an agent routes through it, structured to support AI Act Article 12 record-keeping and Annex IV documentation. Documentation · Setup in one prompt · Quickstart...

Windows-2

Windows-2 BlueKeep脆弱性ラボ - CVE-2019-0708 1. 概要 このリポジトリには、リモートデスクトッププロトコル（RDP）サービスに影響を与えるBlueKeep脆弱性を実証するために設計された、意図的に脆弱なWindowsラボが含まれています。 BlueKeepは、Windowsカーネルに存在する重大な認証前のリモートコード実行（RCE）脆弱性です。この脆弱性により、認証されていない攻撃者がRDPサービスを介してリモートでメモリ破損を引き起こし、システム全体の侵害やサービス拒否につながる可能性があります。...

clawdguard

🦞 ClawdGuard Clawdbot/Moltbot 설치의 보안 강화. 노출된 게이트웨이를 탐지하고 수정합니다. 노출된 Clawdbot/Moltbot 게이트웨이를 탐지하고 수정합니다 문제 • 기능 • 빠른 시작 • Docker • CLI • 수정되는 항목 • 개발 문제 900개 이상의 Clawdbot/Moltbot 인스턴스가 현재 인터넷에 노출되어 있습니다 Shodan에서 포트 18789로 확인 가능. 인증 없이 누구나 다음을 수행할 수 있습니다: 이 문제는 버그가 아니라 잘못된 설정 입니다. 사용자가 gateway.bind...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-5450 DESCRIPTION: Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to version 2.43 with a format wid...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF002 for August 2026

Summary IBM Content Cortex CCx 26.0.0-IF002 addresses CVEs across components including AI Services & tools, FDM and CPE. Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also...

Exploit for CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File...

terminalphone — Updated!

TerminalPhone Encrypted push-to-talk voice communication over Tor hidden services. TerminalPhone is a single, self-contained Bash script that provides anonymous, end-to-end encrypted voice and text communication between two or more parties over the Tor network. It operates as a walkie-talkie: you...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

Exploit for CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free DPCalendar...

CVE-2025-66478-kinda-waf

kinda-waf 특정 페이로드 시퀀스를 대상으로 하는 간단한 임시 WAF 보호 테스터입니다. 웹사이트가 제대로 패치될 때까지 안전하게 유지되도록 도와줍시다! 목적 특정 페이로드 시그니처가 포함된 요청을 탐지하고 차단하여 CVE-2025-66478로부터 보호합니다. 정상적인 트래픽을 방해하지 않으며, 제대로 유지 관리되지 않는 웹사이트를 구합니다. 재시작 후에는 초기화되므로 영구적인 해결책이 아닙니다 요구 사항 Python 3 사용법 스크립트 실행 기본값: localhost: root@kitploit: python main.p...

CVE-2023-5612

Tags RSS 피드에서 공개 이메일 노출 https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ root@kitploit: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email...

CLSA-2026-1788428098 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 6.0.23-tuxcare.8...

ralph

Ralph Claude Code 向け Ralph Wiggum 自律ループ手法の動作する実装です。 背景 Anthropic のプラグインマーケットプレイスにある公式 ralph-wiggum プラグインは、Claude Code v1.0.20（2025年8月）のセキュリティアップデートにより現在動作していません。 セキュリティパッチ（CVE-2025-54795）は、コマンドインジェクション攻撃を防ぐため、$ コマンド置換と複数行の bash コマンドを正しくブロックします。しかし、公式プラグインのコマンドファイルには、この保護を発動させる複数行の bash が含まれています：...

CVE-2024-21262

레코드 CVEs 재현 전용. 관련 자료: LINK GITHUB1 GITHUB2 ISSUE 환경 확인 https://download.docker.com/linux/static/stable/x8664/에서 docker-24.0.6.tgz를 다운로드합니다. root@kitploit: sudo mkdir -p /usr/local/docker-24.0.6 sudo tar -xzf docker-24.0.6.tgz -C /usr/local/docker-24.0.6 sudo ln -sf /usr/local/docker-24.0.6/docke...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...