CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

The base directory spring.cloud.config.server.svn.basedir used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring...

CVE-2026-47836

Spring Cloud Config Server is susceptible to a time-of-check-time-of-use (TOCTOU) attack via the spring.cloud.config.server.svn.basedir property, which specifies where SVN repositories are cloned. The affected version ranges are 5.0.0–5.0.4, 4.3.0–4.3.4, 4.0.0–4.2.8, and 3.1.14 and earlier . The ...

EUVD-2026-66637

The base directory spring.cloud.config.server.svn.basedir used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring...

CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

The base directory spring.cloud.config.server.svn.basedir used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring...

fapro

FaPro Free,Cross-platform,Single-file mass network protocol server simulator 中文Readme Description FaPro is a Fake Protocol Server tool, Can easily start or stop multiple network services. The goal is to support as many protocols as possible, and support as many deep interactions as possible for...

f_hid-4.14-backports

fhid backports for Linux 4.14.190 SM-A525F Three fixes to...

CVE-2026-58624

A flaw was found in the sshd-git component of Apache MINA SSHD, specifically within its GitPgmCommandFactory. An authenticated SSH user could exploit improper input validation to execute arbitrary JGit commands. This allows an attacker to write files to arbitrary locations on the server,...

Binding to an Unrestricted IP Address

Overview github.com/cli/cli/cmd/gh is a GitHub on the command line. It brings pull requests, issues, and other GitHub concepts to the terminal next to where you are already working with git and your code. Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address...

ish builds/813

iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...

reconkg

reconkg Uma ferramenta de triagem de vulnerabilidades. Ela pega o que uma varredura já encontrou, deduz quais CVEs provavelmente se aplicam, informa o quão confiante está e por quê, e fornece os comandos para você verificar por conta própria. Ela não varre nada e não explora nada. Instalação no...

BloodBash

BloodBash Un progetto open source di SquidSec SquidOffense.com · GitHub BloodBash è un analizzatore JSON offline open source per SharpHound e AzureHound, creato e gestito da SquidSec. Costruisce un grafo, mette in evidenza percorsi di attacco e configurazioni errate di AD/Entra e stampa i risulta...

OPENSUSE-SU-2026:21663-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.98.0: chore: fix extra whitespace Default Codespaces port forwarding to loopback Bump gh-aw-actions to v0.87.1 and recompile workflows Fix issue triage action compatibility choredeps: bump golang.org/x/crypto from...

ish

iSH Un progetto per ottenere una shell Linux in esecuzione su iOS, utilizzando l'emulazione x86 in spazio utente e la traduzione delle system call. Per lo stato attuale del progetto, controlla la scheda "issues" e i log dei commit. Pagina App Store Beta di TestFlight Server Discord Wiki con aiuto...

ish

iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...

OPENSUSE-SU-2026:21662-1 Security update for glab

This update for glab fixes the following issues: Changes in glab: - Update to version 1.114.0: featapi: support dynamic custom headers for authenticating proxies featartifact-registry: add glab artifact-registry login --docker featartifact-registry: resolve artifact registries in the Docker...

qemu v11.1.1

=========== QEMU README QEMU is a generic and open source machine & userspace emulator and virtualizer. QEMU is capable of emulating a complete machine in software without any need for hardware virtualization support. By using dynamic translation, it achieves very good performance. QEMU can also...

arp-scan

arp-scan Informazioni arp-scan è uno strumento di scansione di rete che utilizza il protocollo ARP per scoprire e identificare tramite impronta digitale gli host IPv4 sulla rete locale. È disponibile per Linux, BSD, macOS e Solaris sotto licenza GPLv3. Questo è README.md per arp-scan versione...

arp-scan

arp-scan About arp-scan is a network scanning tool that uses the ARP protocol to discover and fingerprint IPv4 hosts on the local network. It is available for Linux, BSD, macOS and Solaris under the GPLv3 licence. This is README.md for arp-scan version 1.10.1-git. Installation Building and...

qemu

QEMU README QEMU è un emulatore e virtualizzatore generico e open source per macchine e spazio utente. QEMU è in grado di emulare una macchina completa via software senza alcuna necessità di supporto hardware per la virtualizzazione. Tramite la traduzione dinamica, raggiunge prestazioni molto...

GHSA-JRW6-7X4Q-W25J senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...