PentagridResponseOverview

PentagridResponseOverview Response Overview Extension for BurpSuite Author: Tobias "floyd" Ospelt, @floydch, http://www.floyd.ch Pentagrid AG, https://www.pentagrid.ch Find exotic responses by grouping response bodies response overview This extension groups all response bodies by similarity and...

jarm

JARM Por favor, lee la publicación inicial del blog sobre JARM para más información. JARM es una herramienta activa de huellas digitales de servidores de seguridad de la capa de transporte TLS. Las huellas digitales de JARM se pueden usar para: Verificar rápidamente que todos los servidores de un...

fixing-google-secops-detections

Google SecOps Chronicle Curated Detections: Flaw Analysis & Tuning This repository documents architectural design flaws, logic discrepancies, and tuning strategies for native Google SecOps Chronicle Curated Detections. While Google Threat Intelligence GTIG provides exceptional conceptual threat...

Python Library sqlparse < 0.6.0 Multiple Vulnerabilities

The version of the sqlparse Python library installed on the remote host is prior to 0.6.0. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists in sqlparse due to the regular expressions used by the lexer to match dollar-quoted strings and multiline...

GHSA-PWGV-4X5Q-6M9F sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

Summary sqlparse ships hard limits MAXGROUPINGDEPTH=100, MAXGROUPINGTOKENS=10000 intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself Ondepth per token-group construction. A 1-2 KB SQL payload e.g. SELECT 1 ... with 500-2000 nesting levels, or ...

CVE-2026-71491

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

Cisco RoomOS Security Hardening Release: July 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. These...

EUVD-2026-39881

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public co...

CVE-2026-23513 FOSSBilling: Broken Authorization in Client Transaction and Order Listings

FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. Details In ServiceTransaction::getSearchQuery and...

[SECURITY] Fedora 43 Update: alertmanager-0.33.0-1.fc43

The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It a lso takes care of silencing and inhibition of alerts...

[SECURITY] Fedora 43 Update: perl-Config-IniFiles-3.001000-1.fc43

Config::IniFiles provides a way to have readable configuration files outside your Perl script. Configurations can be imported inherited, stacked,..., sections can be grouped, and settings can be accessed from a tied hash...

JLSEC-2026-579

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data...

PT-2026-50749

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data...

signal-echo-radar

Signal Echo Radar Signal Echo Radar is a static cybersecurity...

curl: Argument Injection via curl Short-Flag Grouping

This report details how the curl -os command facilitates an Argument Injection vulnerability in applications that wrap the curl command-line tool. The specific command curl -os /etc/passwd --url http://example.com demonstrates a subtle but dangerous behavior. Because -s silent follows -o output,...

[SECURITY] Fedora 43 Update: chunkah-0.3.2-1.fc43

chunkah is an OCI building tool that takes a flat rootfs and outputs a layered OCI image with content-based layers. It optimizes container image layer reuse by grouping files based on their content e.g., by RPM package rather than by Dockerfile instruction order. It is a generalized successor to...

[SECURITY] Fedora 43 Update: alertmanager-0.31.1-2.fc43

The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It a lso takes care of silencing and inhibition of alerts...

[SECURITY] Fedora 42 Update: alertmanager-0.31.1-2.fc42

The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It a lso takes care of silencing and inhibition of alerts...

CVE-2026-2673 OpenSSL TLS 1.3 server may choose unexpected key agreement group

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is...

Firefox Will Give Users an AI Kill Switch for Better Privacy

Not everyone wants AI in their browser. Firefox 148 is introducing easy toggles to disable chatbots and AI tab grouping. Discover how Mozilla is prioritising user choice and privacy in its latest 2026 update...