Astra Linux – Vulnerability in docker.io

Moby is an open-source container framework developed by Docker Inc. It is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component dockerd, which is developed as moby/moby, is commonly referred to as Docker. Swarm Mode, which is...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed the issue of waiting for block writeback in the postread case. If the inode is compressed but not encrypted, the function f2fswaitonblockwriteback was not called properly, resulting in waiting for the GC-ed page...

CLEANSTART-2026-KS25235 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

EUVD-2026-101747

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers c...

CVE-2026-110864 Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers c...

CVE-2026-110864: Improper Authentication

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers c...

Asymmetric Resource Consumption (Amplification)

Overview Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification through the processing of signed XML data, where input-depth and operation-count limits are not properly enforced, DTD processing is not prohibited by default, and entity references and...

CVE-2026-110210 Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...

CVE-2026-110210: Missing Authorization

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...

AlmaLinux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1791810115)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791810115 advisory. - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash that allows attackers controlling the...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2026-122)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-122 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-3206)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3206 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2 : docker (ALASECS-2026-143)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-143 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the fin...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2026-145)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-145 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside ...

mojo-v

Mojo-V: Computación Secreta para RISC-V Mojo-V pronunciado “mojo-five” es una nueva extensión de RISC-V que introduce capacidades de programación orientadas a la privacidad para RISC-V. Mojo-V implementa computación secreta, lo que permite una ejecución segura, eficiente y oblivious a los datos s...

truehunter

Truehunter El objetivo de Truehunter es detectar contenedores cifrados mediante un enfoque rápido y eficiente en memoria, sin dependencias externas para facilitar la portabilidad. Fue diseñado para detectar contenedores de Truecrypt y Veracrypt, aunque puede detectar cualquier archivo cifrado cuy...

dnscat2

NOTA: ¡La contraseña para las descargas .zip es siempre "password"! Introducción ¡Bienvenido a dnscat2, un túnel DNS que NO te enfermará y te matará! Esta herramienta está diseñada para crear un canal de comando y control C&C cifrado sobre el protocolo DNS, que es un túnel efectivo para salir de...

awesome-privacy

A curated list of privacy-respecting apps, software, and providers 🌐 awesome-privacy.xyz CodeBerg Mirror | Submit an Addition | Raw data & API Intro Large data-hungry corporations dominate the digital world but with little, or no respect for your privacy. Migrating to open-source applications wit...

psc

PortShellCrypter -- PSC Este proyecto - así como su proyecto hermano crash - pertenece a mi conjunto de herramientas contra la censura que permite configurar shells encriptados y reenvío TCP/UDP completamente funcionales en entornos hostiles de censura. También es útil para forense para volcar...

notionterm

notionterm Incrusta una reverse shell en páginas deNotion. Hackea mientras tomas notas PARA ➕: Ocultar la IP del atacante en una reverse shell Sin interacción directa entre el atacante y la máquina objetivo. Se usa Notion como proxy que aloja la reverse shell Insertar una demo/prueba rápida en un...