Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. id: CVE-2026-25892 info: name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent Do...

certificate-of-compromise

Сертификат компрометации SoK/Документация по наступательным операциям против службы сертификации Active Directory v1.0.0 Живой документ и вклад сообщества Этот документ — живой документ. Исследования ADCS не статичны: методы получают исправления, открываются новые условия, а анализ сообщества...

solarwinds-sunburst-cve-2020-10148

🔍 Ricerca sulle vulnerabilità Una collezione curata di writeup approfonditi sulle vulnerabilità che coprono incidenti di sicurezza reali nell'ecosistema software. Ogni voce include un'analisi tecnica completa, proof-of-concept, elenco di IOC e indicazioni per la remediation. Scopo: Riferimento...

Umbrella_android

Umbrella Umbrella è un'applicazione mobile Android sviluppata da Security First che fornisce ai difensori dei diritti umani informazioni su cosa fare in qualsiasi situazione di sicurezza e gli strumenti per farlo. Permette all'utente di scegliere cosa vuole fare, come: proteggere i dati; effettua...

spectre-meltdown-checker

Spectre & Meltdown Checker Uno script shell autonomo per valutare la resilienza del tuo sistema contro le diverse CVE di esecuzione transitoria pubblicate dall'inizio del 2018, e fornire indicazioni su come mitigarle. Elenco CVE...

Cybersecurity-Mastery-Roadmap

🛡️ Roadmap Definitiva per la Padronanza della Cybersecurity Una guida completa e passo passo per padroneggiare la cybersecurity dal livello principiante a quello esperto, con risorse selezionate, strumenti e indicazioni di carriera 📋 Indice dei Contenuti Introduzione Come Usare Questa Roadmap...

security-study-plan

Un piano di studio pratico per diventare un ingegnere di sicurezza informatica di successo basato su ruoli come Pentest, AppSec, Cloud Security, DevSecOps e così via con risorse gratuite/a pagamento, strumenti e concetti per eccellere. Coprirà, ma non solo: Completati 1. Competenze Comuni per il...

CyberPup

CyberPup Eine kostenlose, quelloffene Cybersicherheits-App für den Alltag. CyberPup hilft nicht-technischen Nutzern, ihr digitales Leben mit geführten Checklisten, häppchenweisen Lektionen und Werkzeugen wie der Überprüfung auf Datenlecks zu sichern. Alle Anleitungen basieren auf bekannten...

Astra Linux – Vulnerability in Tomcat9

DEPRECATED: There is a vulnerability related to authentication bypass in digest authentication in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and versions prior to 7.0.0...

EventLogging

Avviso Questo repository non è più mantenuto da aprile 2024 BHIS Avviso Questo repository non è più mantenuto da aprile 2024 EventLogging Questo repository contiene indicazioni sulla configurazione della registrazione degli eventi. Queste indicazioni sono suddivise in sezioni, Defensive Readiness...

TheDefendersGuide

O Guia do Defensor - É Perigoso Defender Sozinho, Leve Isto! O que é o Guia do Defensor? O Guia do Defensor é um projeto de Luke Paine e Jonathan Johnson para reunir todos os melhores recursos de defesa para um aspecto específico de um sistema operacional em um único lugar. Muitas vezes, como...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

[SECURITY] Fedora 43 Update: perl-Devel-Cover-1.51-4.fc43

This module provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code. By using Devel::Cover you can discover areas of code not exercised by your tests and determine which tests to create to increase coverage. Code coverage can be considered as an...

metasploitable2-pentest-series

Metasploitable2 Penetration Testing Series A series of vulner...

Security Bulletin: Uncontrolled resource consumption in the Consul Connect authorization endpoint

Summary Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

Exposure of Resource to Wrong Sphere

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the elementId parameter, which allows interpolation of environment variables and secrets into a Twig template even when the Twig sandbox is enabled. A...

Important: Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image

A new satellite/iop-advisor-frontend-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services...

CVE-2026-61466 Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...

CVE-2026-63687

Apache CXF JwtRequestCodeFilter exposes PKCE and OIDC replay protections by copying all claims from a signed request JWT into the authorization parameter map without excluding sensitive parameters. A adversary who can produce a validly-signed JWT (e.g., with a known/compromised client_secret) can...

CVE-2026-71191

A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that semantic x-amz- headers be included in the request signature. An attacker who obtains a presigned PUT URL can inject unsigned headers such as X-Amz-Copy-Source to copy objects...