AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779467653)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779467653 advisory. - There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1779125079)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1779125079 advisory. - In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the PDO Firebird driver...

AlmaLinux 9.6 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.6:CLSA-2026:1769085200)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769085200 advisory. - In GnuPG before 2.4.9, armorfilter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bound...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1783942033)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1783942033 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origi...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1780076591)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1780076591 advisory. - An issue was discovered in writetptentry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver ...

CentOS Linux 7 [TuxCare] Security Update: gnupg2 / gnupg2-smime (CENTOS7:CLSA-2026:1769433341)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1769433341 advisory. - In GnuPG before 2.4.9, armorfilter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds...

xss-methodology

XSS Methodology Not a payload list. This covers how to find X...

SUSE CVE-2026-97920

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

SUSE CVE-2026-97921

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. createvalfield takes the field fro...

SUSE CVE-2026-97922

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit...

SUSE CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

Prober

Verificar supuestos de red de forma reproducible Este proyecto utiliza Ansible para generar archivos de prueba BATS que verifican supuestos de seguridad sobre la infraestructura de red. Las pruebas se ejecutan desde máquinas de prueba "nodos prober " en las que se despliega Prober. Esta herramien...

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time: - The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop. - The verification key ...

GHSA-FFC3-869F-JXW9 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time: - The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop. - The verification key ...

CVE-2024-27198

CVE-2024-27198: La omisión de autenticación en Jetbrain Teamcity conduce a ejecución remota de código Overview TeamCity es un servidor de integración continua y despliegue que proporciona, de serie, pruebas unitarias continuas, análisis de calidad de código e informes tempranos sobre problemas de...

CVE-2025-54135

Below is a fully functional exploit for the CVE-2025-54135 vulnerability in the Cursor IDE, designed to demonstrate a prompt-injection attack that manipulates the Model Context Protocol MCP configuration to achieve remote code execution. This code assumes the attacker has access to a public Slack...

ros2_CVE-2024-28231

Este repositorio incluye una imagen Docker vulnerable de ros2 iron basada en ubuntu 22 y un exploit correspondiente. Explotamos la vulnerabilidad en fastrtps versión 2.10.3, permitiendo la denegación de servicio de un suscriptor remoto mediante un desbordamiento de búfer en el heap. Vulnerable ba...

GraphQLer

¡La única herramienta de prueba de API GraphQL con conciencia de dependencias! GraphQLer es una herramienta de vanguardia diseñada para probar dinámicamente APIs GraphQL con un enfoque en la adaptabilidad. Ofrece una gama de características sofisticadas que agilizan el proceso de prueba y...

CVE-2022-0847-DirtyPipe

title: Análisis de la vulnerabilidad CVE-2022-0847 escalada local de privilegios DirtyPipe date: 2022-03-08 14:41:20 tags: - Escalada de privilegios en Linux categories: - Investigación de seguridad Descripción de la vulnerabilidad ​ CVE-2022-0847 es una vulnerabilidad en el kernel de Linux desde...

Security Bulletin: InfoSphere Data Replication - Data Replication for Availability is affected by arbitrary code execution, cross-site scripting, and denial of service

Summary IBM has released the below fix for IBM InfoSphere Data Replication - Data Replication for Availability Db2U Qreplication container in response to multiple vulnerabilities. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2026-33916...