Security Bulletin: Vulnerabilities reported in netty-codec-4.1.135.Final.jar for APIM

Summary Vulnerabilities found in netty-codec-4.1.135.Final.jar are addressd in APIM 11.1 Vulnerability Details CVEID:CVE-2026-56745 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final...

paracosme

Paracosme - CVE-2022-33318 - Ejecución remota de código en ICONICS Genesis64 Paracosme es un exploit de corrupción de memoria que escribí para atacar la suite Genesis64 v10.97.1 creada por ICONICS y lograr la ejecución remota de código. El exploit se demostró durante el concurso Pwn2Own 2022 Miam...

claude-XML-injection

Claude Sonnet 4.6 — Credential Fabrication via XML Tag Injection Reported: June 14, 2026 | Patched: June 20, 2026 | Anthropic Response: None 56 days Researcher: X1NON Affected Model: Claude Sonnet 4.6 and other non-Haiku Claude models Severity: High CVSS 8.7 Status: Patched — No bounty awarded, n...

jboss-autopwn-1

jboss-autopwn 在2010年BlackHat Europe上展示的JBoss Autopwn——该版本整合了CVE-2010-0738，即Minded Security发现的JBoss认证绕过VERB操控漏洞。 C. Papathanasiou 2010 介绍 该JBoss脚本在目标JBoss AS服务器上部署一个JSP shell。部署后，脚本利用其上传和执行命令的功能提供一个交互式会话。 功能包括： 多平台支持——已在Windows、Linux和Mac目标上测试 支持绑定shell和反向连接shell Windows目标的Meterpreter shell和VNC支持 安...

authproof-sdk

AuthProof SDK AuthProof 是一种面向代理型 AI 的加密授权协议。该领域的大多数协议都基于操作员定义的策略执行——赋予操作员在事后扩展或重新解释用户原始意图的权力。AuthProof 基于不同的信任模型构建：用户自己的私钥签署控制执行的授权对象，并且在授权时和执行前立即验证实时模型状态。用户签署的权限与实时模型状态门控的结合是具体的主张——而非广泛的执行叙事。 不同之处在于： 用户是签署权威。 每个竞争协议（AIP、AITH、OAP、SAGA、AgentSpec）都基于操作员定义的策略执行。在 AuthProof...

lockjaw

Lockjaw - Framework C2 avanzado para Windows v0.2.15 Lockjaw es un framework de comando y control C2 avanzado y modular diseñado para compromisos de red team, simulaciones adversarias y operaciones sigilosas. Utiliza una arquitectura moderna de lenguaje dividido: un Teamserver de Rust de alta...

fixing-google-secops-detections

Google SecOps Chronicle Curated Detections: Flaw Analysis & Tuning This repository documents architectural design flaws, logic discrepancies, and tuning strategies for native Google SecOps Chronicle Curated Detections. While Google Threat Intelligence GTIG provides exceptional conceptual threat...

CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...

aqua-checksums

aqua-checksums Monitoreo externo de integridad de la cadena de suministro para los proyectos de código abierto de Aqua Security. Qué hace este repositorio Este repositorio monitorea continuamente la integridad de los artefactos publicados de Aqua Security imágenes de contenedor, releases de GitHu...

DutchOven

DutchOven Application-scoped Windows network brownouts for deterministic red-team validation. Native C • Windows Filtering Platform • IPv4 + IPv6 • Dynamic cleanup Read the accompanying blog post → Quick start • Profiles • CLI • How it works • Build • BOF • Validation !CAUTION Controlled...

SrHollow

SrHollow Extracción de secretos LSA, reutilización de una copia de sombra VSS preexistente + parser regf en línea + descifrado AES-256 de LSA mediante bcrypt.dll. Cadena en 6 pasos 1. Enumerar\GLOBAL?? mediante NtOpenDirectoryObject + NtQueryDirectoryObject. Elegir el HarddiskVolumeShadowCopyN co...

redteam-ai-benchmark

Red Team AI Benchmark 俄罗斯语版本： README.ru.md Red Team AI Benchmark 是一个命令行界面的模型评估基准测试 。它衡量 LLM 理解和回答红队问题及安全场景的能力；它不是用于执行这些活动的工具。第 2 版使用基于评分标准的数据集，而不是仅根据一个标准答案来评判回答。 默认的 v2 套件包含 datasets/v2/benchmark.jsonl 中的 60 个问题，按领域和难度分组。 仓库状态 原始 GitHub 仓库已不可用；作为其所有者，我被 GitHub 平台封禁。该项目的一个替代镜像仓库（由主要贡献者和合著者维护）位于...

openSUSE 16 Security Update : pcapplusplus (openSUSE-SU-2026:22017-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22017-1 advisory. Changes in pcapplusplus: - Update to version 26.07 libpcap / WinPcap / Npcap is now optional. Bumped the minimum required C++ standard to C++14...

Decepticon v1.2.2

Decepticon — Autonomous Red Team Agent "Another AI hacker? Let us guess — it runs nmap and writes a report." ☁️ Don't want to self-host? Decepticon is live in the cloud. Skip the Docker setup — run autonomous red-team engagements right from your browser. Install Prerequisites : Docker and Docker...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, hadoop-client-modules, wso2is, cassandra-fips, elasticsearch, cass-config-builder-fips, logstash, spark, flyway, druid, opensearch, camunda-zeebe, dependency-track, gradle, keycloak-config-cli, jenkins, pinot-fips, zaproxy,...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, hadoop-client-modules, wso2is, cassandra-fips, elasticsearch, cass-config-builder-fips, logstash, spark, flyway, druid, opensearch, camunda-zeebe, dependency-track, gradle, keycloak-config-cli, jenkins, pinot-fips, zaproxy,...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: sonarqube, keycloak, apache-nifi, trino, spark, strimzi-kafka-operator, spdx-tools-java, opensearch, scala, apicurio-registry, logstash, keycloak-config-cli, cass-config-builder, akhq, dependency-track, gradle, infinispan, apache-nifi-registry, wildfly, apache-tika,...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: sonarqube, keycloak, apache-nifi, trino, spark, strimzi-kafka-operator, spdx-tools-java, opensearch, scala, apicurio-registry, logstash, keycloak-config-cli, cass-config-builder, akhq, dependency-track, gradle, infinispan, apache-nifi-registry, wildfly, apache-tika,...

CVE-2025-32432

CVE-2025-32432 - PoC de RCE no autenticado en Craft CMS Prueba de concepto funcional para CVE-2025-32432 , una vulnerabilidad de ejecución remota de código no autenticada en Craft CMS versiones hasta e incluyendo 5.6.16 también afecta a las ramas 4.x y 3.x en rutas de código equivalentes. Palabra...

MAL-2026-17469 Malicious code in infrabench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f8f2854fc15ef2f2a5d4c44b050aa9f3c87a7f5a832949390cf22ccd7882a6 The package's public API harness.runedge= downloads two sha256-pinned gzipped native binaries 'inference-core.bin.gz' and 'edge-conn.bin.gz' from...