the-bastion

🔒 The Bastion 概要 Bastion（バスティオン）は、運用チーム（システム管理者、開発者、データベース管理者など）が、通常 ssh を使用して、デバイス（サーバー、仮想マシン、クラウドインスタンス、ネットワーク機器など）に安全に接続するための唯一のエントリポイントとして使用されるマシンのクラスターです。 The Bastion は、インフラストラクチャ全体に対する認証、認可、トレーサビリティ、および監査可能性のメカニズムを提供します。 ユーザーとインフラストラクチャの間に位置することで、The Bastion...

teleport

Teleport 为基础设施提供连接、身份验证、访问控制和审计。 你可以使用 Teleport 来： 为你的所有云端和本地（on-prem）基础设施设置单点登录（SSO）。 保护对服务器、Kubernetes 集群、数据库、Windows 桌面、Web 应用和云 API 的访问，而无需长期有效的密钥或密码。 无需 VPN 或堡垒主机，即可建立安全隧道，访问 NAT 和防火墙后面的资源。 记录并审计 SSH、Kubernetes、数据库、RDP 和 Web 会话中的活动。 在用户、机器、工作负载和资源类型之间应用一致的基于角色的访问控制和基于属性的访问控制（RBAC/ABAC）。...

EUVD-2026-62062

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial...

mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and...

PT-2026-77711

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Install. The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data...

PT-2026-62426

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.4.0 through 8.4.10 MySQL Server versions 9.7.0 through 9.7.1 MySQL Cluster versions 8.0.0 through 8.0.47 MySQL Cluster versions 8.4.0 through 8.4.10 MySQL Cluster versions 9.7.0 through 9.7.1 Description An issue exists...

The Librarian does not secure its interface, allowing for access to internal system data

Overview Multiple vulnerabilities were discovered in The Librarian, an AI-powered personal assistant tool provided by the company TheLibrarian.io. The Librarian can be used to manage personal email, calendar, documents, and other information through external services, such as Gmail and Google...

EUVD-2018-15141

Malware in sbrugna...

Exploit for Server-Side Request Forgery in Wkhtmltopdf

CVE-2022-35583 Pandoc SSRF POC A Server-Side Request Forgery...

CVE-2025-51591

A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilitie...

CVE-2025-49825 Teleport allows remote authentication bypass

Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch...

CVE-2023-27532

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts...

CVE-2022-29171

Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service. The Gitolite code host integration with Phabricator allows Sourcegraph site admins to specify a callsignCommand, which is used to obtain...

CVE-2023-27532

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts...

Vulnerability fixed in Veeam Backup & Replication

A vulnerability has been fixed in Veaam Backup & Replication. A unauthenticated malicious person with access to the network port of the Backup Server, could exploit the vulnerability to retrieve encrypted credentials from the configuration. Using these credentials, the malicious party can then ga...

Vulnerabilities fixed in Cisco NX-OS and FXOS

Cisco has fixed vulnerabilities in NX-OS and FXOS for various Firepower, Nexus and UCS hardware. A malicious party could exploit the vulnerabilities to cause a Denial-of-Service, or use command-injection to execute commands on the vulnerable system with root privileges. To exploit the...

Vulnerability fixed in Yokogawa Centum controller FCS products

Yokogawa has fixed a vulnerability in Centum controller FCS products. A malicious party could potentially exploit it to cause a denial-of-service. To exploit the vulnerability, the malicious party needs access to the production infrastructure. It is good practice not to have such infrastructure...

Remote code execution

Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service. The Gitolite code host integration with Phabricator allows Sourcegraph site admins to specify a callsignCommand, which is used to obtain...

CVE-2022-21394

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2021-2374

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server...