Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced. IBM WebSphere Liberty has been updated within IBM CICS TX Advanced to address these vulnerabilities. Vulnerability Details CVEID:CVE-2026-14525 DESCRIPTION: IBM WebSphere...

kurasagi

kurasagi kurasagi 是适用于 Windows 24H2 - 25H2 的 PatchGuard 绕过完整 POC。 更多信息请参阅 product 分支，其中包含详细介绍该绕过方法的 PDF 论文。 如果出现任何与CRITICALSTRUCTURECORRUPTION（PatchGuard）相关的 BSOD，请创建 issue 并附上相关信息！ 免责声明 1. 请仅将其用于教育目的！ 2. 运行时请勿开启基于虚拟机监控程序的安全功能！（否则会导致 BSOD！） 3. 使用 kdmapper 加载驱动。 4. 在加载 kurasagi 之后，我们发现当你使用...

CVE-2026-86466

The Authentik OAuth path in the Apache Airflow FAB auth manager fails to validate the issuer and audience claims of the accepted id_token. An attacker holding a valid token minted by the same Authentik instance for a different client application can present it to Airflow and be authenticated as t...

EUVD-2026-80327

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-86466 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

EUVD-2026-80325

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-19640 Security Advisory 0170

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-19640

CVE-2026-19640 is an incorrect authorization flaw (CWE-863) in Arista EOS affecting the gNMI (gRPC Network Management Interface) . An authenticated user with gNMI access may receive incorrect authorization results, potentially gaining access beyond their assigned permissions. Arista discovered th...

CVE-2026-19640 Security Advisory 0170

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

weave-gitops

Weave GitOps Weave GitOps 是一个简单、开源的开发者平台，专为那些希望使用云原生应用但缺乏 Kubernetes 专业知识的人群打造。体验轻松启用 GitOps 并在集群中运行应用的便捷性。利用 Git 与团队成员协作，让新部署变得简单又安全。从开发者运行应用所需的基本功能开始，然后轻松扩展，定义并运行您自己的企业平台。 在 Kubernetes 上运行 Weave GitOps 后，您可以获得： 1. 应用运维：管理和自动化应用及其他组件的部署管道 2. 平台：在云端或本地拥有您自己的自定义 PaaS 的便捷方式 3. 扩展：协调 Kubernetes 的...

vpod v0.8.4

Vpod Live demo • Getting Started • Documentation • Issues • Contributing What is a vpod ? A vpod is a lightweight, portable sandbox that gives an untrusted process an instant Linux environment. It uses a RISC‑V architecture and runs entirely inside WebAssembly. Fast startup : Boot in under a...

firmware

🦈 Bruce Bruceは、Red Teamオペレーションを迅速かつポータブルにするために作られた、オフェンシブセキュリティツールを満載した多機能ESP32ファームウェアです。 また、M5Stack、LILYGO、RockBase IoT、Elecrowの製品をサポートしており、Cardputer、Sticks、M5Cores、T-Decks、T-Embedsでも優れた動作をします。 ⚡ 公式DevKitを手に入れよう！ RF REAPER RF REAPER は、Bruceのために特別に設計されたカスタムPCB DevKitです！...

kitty

Introduction | Sulley: Boo? | Boo: Kitty! What is Kitty? Kitty is an open-source modular and extensible fuzzing framework written in python, inspired by OpenRCE's Sulley and Michael Eddington's and now Deja Vu Security's Peach Fuzzer . Goal root@kitploit: When we started writing Kitty, our goal w...

Nuages

Nuages Nuagesはモジュラー式C2フレームワークです。 ドキュメントやチュートリアルについてはWikiを参照してください。ヘルプ、バグ報告、機能リクエストは遠慮なくIssueを開いてください。 はじめに...

pac4j-check

pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...

awesome-privacy

Awesome Privacy 免费、开源且尊重隐私的服务列表，以及专有服务的替代品。 关于 | 贡献 | 引用 | 讨论 !IMPORTANT 匿名性、隐私和安全性经常被互换使用，但它们实际上代表不同的概念。理解它们之间的区别非常重要。在下方这一节中了解更多。 此列表的主要重点是提供优先考虑隐私的替代品。这些替代品让您掌控自己的数据，并且不会收集或出售这些数据。 目录 2FA 分析 Android Android 应用商店 Android 去臃肿工具 Android 拨号器 Android 文件管理器 Android 相册 Android 键盘 Android 启动器 人工智能...

go_parser

Yet Another Golang binary parser for IDAPro English |中文 NOTE : Now the latest master branch is the Python3 version. The old master branch has been changed to branch py2 , and temporarily not maintained. Instructions for Python3 branch This version is developed and tested on macOS/Windows, IDA7.4+...

go_parser

IDAPro用のYet Another Golangバイナリパーサー 英語 |中文 注記 : 現在の最新のmasterブランチはPython3版です。以前のmasterブランチはpy2 ブランチに変更され、一時的にメンテナンスされていません 。 Python3ブランチの説明 このバージョンはmacOS/Windows、IDA7.4+、Python3.8.xで開発・テストされています。他のプラットフォームやバージョンで問題がある場合は、issueやPull Requestを送信してください。...

CVE-2026-86462

Apache Airflow FAB provider contains a session-invalidation gap in the Admin user-edit PATCH endpoint . When a user's password is changed through this path, existing database-backed sessions are not invalidated because the PATCH handler never calls the session-invalidation helper. An attacker alr...

EUVD-2026-80320

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...