smt878u-ionstack-poc

smt878u-ionstack-poc Pure-C, host-assisted re-root proof of concept for Samsung Galaxy Tab S7 SM-T878U / gts7l against CVE-2026-43499 IonStack / GhostLock. The runtime chain uses native C/ELF components only. It does not require Python, Java, DEX, appprocess, or a JVM on the Android target. ADB i...

enseal

enseal Condivisione sicura e effimera di segreti per sviluppatori. Smetti di incollare segreti su Slack. enseal rende il percorso sicuro più veloce di quello insicuro — condividi file .env e segreti attraverso canali crittografati e monouso con un solo comando e zero configurazione.bash sender $...

studio

ShipSec Studio Open-Source-Plattform zur Orchestrierung von Sicherheits-Workflows. ShipSec befindet sich derzeit in aktiver Entwicklung. Wir optimieren die Plattform für einen stabilen Produktionseinsatz und leistungsstarke Sicherheitsabläufe. ShipSec Studio bietet eine visuelle DSL und...

bromure

Bromure Calcolo sicuro ed effimero in VM Linux usa e getta su macOS. → Dettagli completi, screenshot e download su bromure.io Questo repository contiene due app gemelle, entrambe costruite su Virtualization.framework di Apple: Bromure — ogni sessione del browser viene eseguita in una VM Linux usa...

matchlock

Matchlock Experimentell: Dieses Projekt befindet sich noch in aktiver Entwicklung und kann breaking changes unterliegen. Matchlock ist ein CLI-Tool zum Ausführen von KI-Agenten in flüchtigen Mikro-VMs – mit Netzwerk-Whitelisting, Secret-Injection via MITM-Proxy und VM-Isolation. Deine Secrets...

torchat

TorChat - Anonymer P2P-Chat Sicherer, privater und anonymer Peer-to-Peer-Chat über das Tor-Netzwerk. Was ist TorChat? Es ist ein leichtgewichtiges, datenschutzorientiertes Nachrichtentool, mit dem Sie direkt mit anderen über das Tor-Netzwerk kommunizieren können – ohne zentrale Server. Es wurde f...

foxcage

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

Astra Linux – Vulnerability in wpa

In Hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker who has successfully bootstrapped public keys with another entity using PKEX in the past will be able to subvert future bootstrapping attempts by passively observing the public keys. By...

Malicious code in @apicity/meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581 dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload ho...

CLEANSTART-2026-ZY67243 Security fixes in incubator-kie-kogito-data-index-ephemeral 10.1.0-r1

Package incubator-kie-kogito-data-index-ephemeral version 10.1.0-r1 fixes 43 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-2240, CVE-2025-48924, CVE-2025-49574...

GHSA-VH45-F885-3848 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Summary sm-crypto npm package 0.4.0, the latest release, published 2026-01-20 generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance src/sm2/utils.js: const rng = new SecureRandom. SecureRandom is jsbn's PRNG, which seeds an ARC4 stream from...

PYSEC-2026-874 OpenStack Nova DoS through ephemeral disk backing files

The libvirt driver in OpenStack Compute Nova before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service disk consumption by creating and deleting instances with unique ostype settings, which triggers the creation of a new ephemeral disk backing...

CVE-2026-54019

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as...

GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines

AI-powered agents are increasingly embedded in continuous integration and continuous delivery/deployment CI/CD pipelines to autonomously review pull requests PRs, triage issues, and maintain codebases. These agents ingest untrusted content while operating with elevated repository permissions,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after checkestalblished. syzkaller reported a warning 0 in inetcskdestroysock, with no repro. WARNONinetsksk-inetnum && !inetcsksk-icskbindhash; However, syzkaller’s log...

SUSE-SU-2026:21396-1 Security update for libssh

This update for libssh fixes the following issues: - Update to version 0.11.4: - CVE-2026-0964: SCP Protocol Path Traversal in sshscppullrequest bsc1258049 - CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files bsc1258045 - CVE-2026-0966: Buffer underflow in...

CVE-2026-33697

Cocos AI is a confidential computing system for AI. The current implementation of attested TLS aTLS in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP and Intel TDX deployment targets supported by CoCoS...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error during the intra-handshake attestation.. An attacker can impersonate a trusted service endpoint and gain unauthorized access to sensitive data or operations by extracting the ephemeral TLS private key through...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error during the intra-handshake attestation.. An attacker can impersonate a trusted service endpoint and gain unauthorized access to sensitive data or operations by extracting the ephemeral TLS private key through...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error during the intra-handshake attestation.. An attacker can impersonate a trusted service endpoint and gain unauthorized access to sensitive data or operations by extracting the ephemeral TLS private key through...