Null Byte Injection

Netty is vulnerable to null byte injection. The vulnerability is due to the MqttEncoder not validating client identifiers, topics, usernames, and PUBLISH topic names before encoding, where prohibited null bytes can be inserted into MQTT UTF-8 string fields and attackers can exploit this by...

rinhit

RinHit RinHit - macOS ecosystem reconnaissance framework. Collects artifacts from the Apple ecosystem to build timelines of network activity, cross-device identity, and physical location correlation. This is the open-source reconnaissance module. The closed-source Swift payload rinhit-agent is...

CVE-2026-104036

A flaw in the SSSD NFS idmap plugin allows for an out-of-bounds write when retrieving cached user or group names. The vulnerability occurs because the plugin identifies that an entry exceeds the destination buffer size but fails to abort the operation before copying the data. A local attacker can...

CVE-2026-106488: Improper Authentication

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106460: Improper Authentication

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email...

SSRF impact in cloud environments: Beyond network reachability

Server-Side request forgery SSRF represents a significant vulnerability class in cloud-hosted services because it directly intersects application behavior with cloud network and identity systems. In the most common case, SSRF is an application-layer vulnerability in which a service accepts...

CVE-2026-104048: Comparison Using Wrong Factors

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

PT-2026-106751

Name of the Vulnerable Software and Affected Versions MsQuic versions prior to 2.4.20 MsQuic versions prior to 2.5.11 MsQuic versions prior to 2.6.1 Description MsQuic clients using the OpenSSL or QuicTLS TLS backends fail to properly verify that a server certificate matches the intended target...

PT-2026-107263

Name of the Vulnerable Software and Affected Versions Backstage versions 0.3.0 through 0.6.14 Backstage versions 0.7.0 through 0.7.4 Description The @backstage/plugin-auth-node package fails to consistently honor explicit negative email verification during shared OAuth profile normalization. This...

PT-2026-107269

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.4.20 Description The @backstage/plugin-auth-backend-module-oidc-provider package contains improper authentication within the OIDC provider. In deployments utilizing OIDC email-based identity resolution with a...

PT-2026-107231

A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...

EUVD-2026-88547

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion...

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key x does not correspond to the supplied private key d. When d is present, OKPAlgorithm.fromjwk constructs the Ed25519/Ed448 private key from d without verifying that the public key derived from d matches x...

GHSA-X33G-CR3X-6449 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key x does not correspond to the supplied private key d. When d is present, OKPAlgorithm.fromjwk constructs the Ed25519/Ed448 private key from d without verifying that the public key derived from d matches x...

LinusWare-Source-Code-Internal

Linusware 1.2 — Source Code & Engine Architecture Reconstructed, Reverse-Engineered & Documented by tekkenbugatti Target Platform: Linux x8664 / Luau / Roblox Runtime Engine Overview Linusware 1.2 is a native Linux x8664 runtime extension and execution engine for Roblox / Luau. This repository...

keycloak__keycloak_CVE-2014-3656_1-0-5-Final

Open Source Identitäts- und Zugriffsverwaltung Fügen Sie Anwendungen Authentifizierung hinzu und schützen Sie Dienste mit minimalem Aufwand. Keine Notwendigkeit, sich um die Speicherung von Benutzern oder die Authentifizierung von Benutzern zu kümmern. Keycloak bietet Benutzerföderation, starke...

EUVD-2026-92532

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

CVE-2020-25769

GOG Galaxy Local Privilege Escalation - CVE-2020-25769 GOG Galaxy 2.0 es una plataforma desarrollada por CD Project diseñada como tienda, entrega de software, red social y como un lanzador de juegos unificado. En Windows, el cliente depende del componente GalaxyClientService para manejar tareas...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 es una vulnerabilidad crítica en WSO2 Identity Server, una plataforma de gestión de identidad y acceso de código abierto. La vulnerabilidad permite a atacantes remotos cargar archivos JSP maliciosos que pueden ejecutar comandos arbitrarios en el sistema objetivo con...

ldapsdk

UnboundID LDAP SDK para Java Descargue la última versión del LDAP SDK aquí El UnboundID LDAP SDK para Java es una biblioteca Java rápida, potente, fácil de usar y completamente gratuita y de código abierto para comunicarse con servidores de directorio LDAP. Ofrece mejor rendimiento, mejor facilid...